Which versions of webrix-docs1 are malicious?

The following npm versions of webrix-docs1 are flagged malicious: 10.2.11. Treat any of these as compromised.

How do I remediate webrix-docs1 if I installed it?

webrix-docs1 is a typosquat — you almost certainly intended a legitimately-named package. Remove webrix-docs1, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed webrix-docs1 — how do I know if it already compromised me?

If webrix-docs1 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is webrix-docs1 part of a known attack campaign?

Yes — webrix-docs1 is associated with the IN-MAL-2026-009221 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find webrix-docs1 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for webrix-docs1 (version 10.2.11).

Malicious package

webrix-docs1npm

Advisory published Jul 9, 2026Updated Jul 9, 2026

webrix-docs1 is a confirmed malicious npm package (MAL-2026-10081) that typosquats a legitimate package to trick installs (malicious version 10.2.11). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in webrix-docs1 (npm)

MAL-2026-10081

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall webrix-docs1

What this malware does

The package declares a preinstall hook (node index.js) that fires automatically on npm install. The script requires child_process, os, https, and http, collects hostname, platform, arch, username/uid/gid, shell, home directory, CPU/memory stats, cwd, and the output of whoami/id, then POSTs the JSON payload to a hardcoded Burp Collaborator (oastify.com) subdomain at https://c7kfuaf25guwigaz6r03kxet0k6bu3is.oastify.com/detox56. The package has an empty description and empty author, presents no advertised functionality, and its name mimics the webrix project — consistent with dependency-confusion/typosquat recon. Installing the package directly leaks installer host and user identifiers to an attacker-controlled OAST endpoint.

Malicious versions

1 flagged

10.2.11

Indicators of compromise (SHA-256)

20cdefe1415c5b5245f36b10ea0de9033433b479768c2cc785ad2742b9433fce

Detection & response playbook

Typosquat

Find it
Search your lockfiles and build artifacts for webrix-docs1 (version 10.2.11).
If you installed it — respond
webrix-docs1 is a typosquat — you almost certainly intended a legitimately-named package. Remove webrix-docs1, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If webrix-docs1 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. webrix-docs1 on npm has been identified as a malicious package (version 10.2.11 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-009221

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks webrix-docs1-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database