Malicious npm package zxcvb90-utils-helper exfiltrates page DOM to webhook.site collector
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
The npm package zxcvb90-utils-helper@1.0.1 is confirmed malware (GHSA-2rfv-gw97-96gg, CWE-506). Its main entry index.js, on require/import, sends URL-encoded document.documentElement.outerHTML (truncated to 4000 chars) via fetch to a hardcoded attacker-controlled webhook.site collector, silently exfiltrating secrets, tokens, and user data rendered in the page in browser bundles, jsdom, and Electron environments. The package has no declared purpose and an empty description. package.json also declares a self-dependency on itself with an unpinned pre-release range (^0.0.0-stage), so installs resolve whatever bytes the registry currently serves with no integrity pin. No patched versions exist; the only remediation is removal. Reported by Amazon Inspector via OpenSSF malicious-packages.
What to do
- Remove zxcvb90-utils-helper from all dependency trees and lockfiles immediately
- Audit environments where it was imported (browser bundles, jsdom, Electron) for exfiltrated DOM data; rotate any secrets, tokens, or credentials that may have been rendered in affected pages
- Check install logs and lockfiles for the unpinned self-dependency and any unexpected resolutions
- Block webhook.site egress in build and runtime environments
- Scan for other typosquat-style utility packages with no description or purpose
Sources
All live incidents on Threat Watch
