# MAL-2026-13991: Malicious code in webautomation_js (npm)


- **Type:** Malicious package
- **Package:** `webautomation_js` (npm)
- **Published:** 13 Aug 2026

## What is MAL-2026-13991?

MAL-2026-13991 is a malicious package in webautomation_js, published on 13 Aug 2026. 

### Official description

index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported function appends a caller-supplied argument to a hardcoded API_BASE_URL and issues an axios request to it; both the axios module name and every fragment of the destination URL are reconstructed at runtime from the RC4-encoded string array, so the destination is not visible in normal source. The package description ("logger tool for validation entry"), README, and empty author metadata do not disclose the destination. The documented purpose does not require a hidden remote endpoint, and legitimate HTTP client libraries do not RC4-encrypt their endpoint strings. Any caller invoking the exported function sends their argument to an attacker-controlled destination they cannot see.

## What should I do about MAL-2026-13991?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-13991 is a malicious package: webautomation_js (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-13991/ (Markdown: https://insights.sbomify.com/MAL-2026-13991/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-13991

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-13991/
Summaries are generated and may contain mistakes; the official description above is the record.