Package evidence

[email protected]

Webhook Exfil Endpoint: matched "webhook.site"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 1,490Niche · −30% score
Versions published: 338
First published: Jan 2026
Publisher: dnszlsk

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'

Publisherdnszlsk

Artifact bytes710,944

Previous version2.11.76

Published2026-06-08T14:52:31.227Z

SHA-2561ee1b661874156c45af80254e3ba6496a50999315373ec099d27317f1e954190

Why flagged

What the scanner saw

Webhook Exfil Endpoint: matched "webhook.site"

1 candidate cluster(s) currently reference this release.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

6h agoLast checked

highRisk

196Score

2.11.77Version

Status history (1 event)

new → available6h ago · risk high · score 196 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burstactive

dnszlsk

2 members · evidence strength 61

Publisher / release actor burstcandidate

dnszlsk

2 members · max score 196

Evidence

Static findings

23 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Webhook Exfil Endpoint	package/src/scanner/ast-detectors/constants.js	matched "webhook.site"	40
high	Js Split Join Obfuscation	package/src/scanner/deobfuscate.js	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.	40
high	Webhook Exfil Endpoint	package/src/rules/index.js	matched "canarytokens.org"	40
high	Webhook Exfil Endpoint	package/src/sandbox/index.js	matched "discord.com/api/webhooks/"	40
high	Webhook Exfil Endpoint	package/src/sandbox/network-allowlist.js	matched "webhook.site"	40
high	Webhook Exfil Endpoint	package/src/response/playbooks.js	matched "webhook.site"	40
high	DNS / OAST exfiltration	package/src/scanner/ast-detectors/constants.js	matched "oastify.com"	30
high	DNS / OAST exfiltration	package/src/rules/index.js	matched "oastify.com"	30
high	DNS / OAST exfiltration	package/src/sandbox/network-allowlist.js	matched "oastify.com"	30
high	DNS / OAST exfiltration	package/src/scanner/package.js	matched "oast.fun"	30
high	DNS / OAST exfiltration	package/src/response/playbooks.js	matched "oastify.com"	30
medium	Credential file access	package/src/scanner/package.js	matched ".npmrc"	10

Show all 23 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Webhook Exfil Endpoint	package/src/scanner/ast-detectors/constants.js	matched "webhook.site"	40
high	Js Split Join Obfuscation	package/src/scanner/deobfuscate.js	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.	40
high	Webhook Exfil Endpoint	package/src/rules/index.js	matched "canarytokens.org"	40
high	Webhook Exfil Endpoint	package/src/sandbox/index.js	matched "discord.com/api/webhooks/"	40
high	Webhook Exfil Endpoint	package/src/sandbox/network-allowlist.js	matched "webhook.site"	40
high	Webhook Exfil Endpoint	package/src/response/playbooks.js	matched "webhook.site"	40
high	DNS / OAST exfiltration	package/src/scanner/ast-detectors/constants.js	matched "oastify.com"	30
high	DNS / OAST exfiltration	package/src/rules/index.js	matched "oastify.com"	30
high	DNS / OAST exfiltration	package/src/sandbox/network-allowlist.js	matched "oastify.com"	30
high	DNS / OAST exfiltration	package/src/scanner/package.js	matched "oast.fun"	30
high	DNS / OAST exfiltration	package/src/response/playbooks.js	matched "oastify.com"	30
medium	Credential file access	package/src/scanner/package.js	matched ".npmrc"	10
low	Credential file access	package/src/scanner/ai-config.js	matched ".npmrc"	5
low	Credential file access	package/src/shared/bundle-detect.js	matched "AWS_ACCESS_KEY"	5
low	Credential file access	package/src/integrations/canary-tokens.js	matched "aws_access_key"	5
low	Credential file access	package/src/scanner/ast-detectors/constants.js	matched ".npmrc"	5
low	Credential file access	package/src/scanner/dataflow.js	matched ".npmrc"	5
low	Credential file access	package/src/rules/index.js	matched ".npmrc"	5
low	Credential file access	package/src/sandbox/index.js	matched ".npmrc"	5
low	Credential file access	package/src/ml/llm-detective.js	matched ".npmrc"	5
low	Credential file access	package/src/scanner/paranoid.js	matched ".npmrc"	5
low	Credential file access	package/src/response/playbooks.js	matched ".npmrc"	5
low	Credential file access	package/src/scanner/temporal-ast-diff.js	matched ".npmrc"	5

Manifest

Package metadata

Scripts9

compress-iocsnode -e "const fs=require('fs');const zlib=require('zlib');zlib.gzip(fs.readFileSync('src/ioc/data/iocs.json'),(e,b)=>{if(e)throw e;fs.writeFileSync('iocs.json.gz',b);console.log('Compressed: '+b.length+' bytes')})"
fp-clustersnode scripts/analyze-fp-clusters.js
linteslint src bin --ext .js
prepublishOnlynode -e "if(!process.env.CI){console.error('ERR: Publish via CI workflow (tag v* push). Local publishes are disabled.');process.exit(1)}"
scannode bin/muaddib.js scan .
testnode tests/run-tests.js
test:integrationnode tests/run-tests-integration.js
test:regression-checknode scripts/regression-check.js
updatenode bin/muaddib.js update

Dependencies6

@inquirer/prompts8.5.2
acorn8.16.0
acorn-walk8.3.5
adm-zip0.5.17
js-yaml4.2.0
web-tree-sitter^0.26.9