OSV ID
MAL-2026-13990
Ecosystem
npm
Summary
On npm install , the package's postinstall lifecycle script collects installer host identifiers (hostname, platform, architecture, Node.js version, package name, npm lifecycle event) and POSTs them as JSON to the hardcoded remote endpoint https://bhvte4h4.instances.poc.jchunt.top/wct-st. The beacon fires automatically with no consent, configuration, or opt-out. The package name resembles the deprecated web-component-tester , consistent with a typosquat / dependency-confusion beacon shape.
Source: amazon-inspector (3065a54d66ae4872334224443453c85f98c9ab8ae9d87df215bb51a5ba5e7595)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.