debug-proxy-chrome-devtools @1.0.2
Vulnerability report · Last retrieved from osv.dev August 14, 2026 at 2:31 AM UTC
OSV ID
MAL-2026-13948
Ecosystem
npm
Summary
debug-proxy-chrome-devtools@1.0.1 declares a postinstall hook ( "postinstall": "node install.js" ) that automatically executes on npm install . install.js uses child_process.execSync to run whoami on the installer's machine and then issues an https.get to a hardcoded webhook.site collector ( https://webhook.site/cfe35ac2-bec3-48b8-bae1-a49dea5412c2 ), passing the captured command output and hostname/command identifiers as URL query parameters. The package advertises itself as a Chrome DevTools debug proxy; that stated purpose has no need for shell reconnaissance or beaconing to a third-party request-inspection service. The combination of automatic install-time execution, capture of installer-side identity data, and a hardcoded non-first-party exfiltration endpoint matches the reconnaissance/beacon shape of a malicious postinstall payload.
Source: amazon-inspector (b7a0986932a47f49b162ea0438acfd0b6293e027e8ac2da46eb1221c5d52646c)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.