MAL-2026-11193 Malicious code in litespeed-cache (npm)

This npm package (a name resemblance to the WordPress LiteSpeed Cache plugin, which is not an npm module) ships a preinstall script and a top-level index.js that both collect os.hostname() and os.userInfo().username and issue an HTTPS request to a hardcoded webhook.site endpoint (https://webhook.site/c72c8172-a424-4a19-91b4-28f40cae3c83). The beacon fires automatically on npm install via the preinstall lifecycle hook, and is repeated at module load so that any consumer that require()s or imports the package also transmits host identifiers, bypassing --ignore-scripts. webhook.site is an anonymous third-party request-inspection collector; there is no functional package behavior beyond the beacon.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.