Vulnerability MAL-2026-18699
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
10 days ago
October 26, 2026 at 12:00 AM UTC
Malicious code in wiselllx (npm)
0.0.1 and 1.0.1
0.0.1 and 1.0.1
Summary
Malicious code in wiselllx (npm)
Details
wiselllx is a dependency-confusion package (versions up to 99.0.1) from the same campaign as troubleshooting (MAL-2026-17641): a postinstall script runs beacon.cjs, which POSTs the installing host's name, install path and working directory to a hard-coded collector, and index.js, byte-identical to the troubleshooting payload (sha256 a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d), does the same when imported.
References
Impacted packages
Timeline
Published
10 days ago
October 26, 2026 at 12:00 AM UTC
Last Modified
3 hours ago
November 05, 2026 at 05:15 AM UTC