Malicious code in wiselllx (npm)
MAL-2026-18699
Published · Modified
Dependency scanning
Check whether wiselllx is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
wiselllx is a dependency-confusion package (versions up to 99.0.1) from the same campaign as troubleshooting (MAL-2026-17641): a postinstall script runs beacon.cjs, which POSTs the installing host's name, install path and working directory to a hard-coded collector, and index.js, byte-identical to the troubleshooting payload (sha256 a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d), does the same when imported.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes