{"answers":{"affected":"1 open source package ship an affected version, including @wbnr/design.","exploited":"There is no known exploitation of MAL-2026-11196 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-11196 is a malicious package in @wbnr/design, published on 30 Jul 2026."},"fix_prompt":"MAL-2026-11196 is a malicious package: @wbnr/design (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-11196/ (Markdown: https://insights.sbomify.com/MAL-2026-11196/index.md)","id":"MAL-2026-11196","markdown":"https://insights.sbomify.com/MAL-2026-11196/index.md","name":"MAL-2026-11196","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package's preinstall lifecycle script runs automatically on `npm install`. It reads the installer's username (from USER/USERNAME environment variables) and the machine hostname (via os.hostname()), then embeds those identifiers along with the package name and a timestamp into both a DNS lookup and an HTTPS GET request directed at a hardcoded Burp Collaborator subdomain, 4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com. The package name and scope (@wbnr) and its self-description indicate a dependency-confusion payload targeting an internal organization scope; any environment that resolves @wbnr/design from public npm will leak installer host identifiers to the attacker-controlled out-of-band endpoint. The 'harmless bug bounty PoC' framing in the package description does not change the observable behavior: installer-owned identifiers leave the machine to a third-party OOB collector on install.\n\nThe OpenSSF Package Analysis project identified '@wbnr/design' @ 99.3.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @wbnr/design (npm)","id":"MAL-2026-11196","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@wbnr/design","purl":"pkg:npm/%40wbnr/design","source":"MAL-2026-11196"}],"products":null,"published":"2026-07-30","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-11196/"}