If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
webpackbootstrapscripts@5.110.3 typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader (index-z2b7r4.js) XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a Scramjet/wisp WebSocket proxy that routes page traffic through operator-controlled relays. The loader matches (same sha256) sibling packages webpackbootstrapscripts and @zaka13/thing by the same publisher (zaka13). Harm is browser-side when the asset is served; no install script runs.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- dyingefforlessefforlessours[.]com other packages →
- wisp[.]mercurywork[.]shop other packages →
URLs
- hxxps://dyingefforlessefforlessours[.]com/is512uku other packages →
- wss://wisp[.]mercurywork[.]shop/wisp/ other packages →
- wss://theavancehotel[.]com/fairs/ other packages →
- wss://science-340154168[.]b-cdn[.]net/api/ other packages →