Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in @catamania/front-components (npm)

The npm package @catamania/front-components contained malicious code in postinstall.js that performed host reconnaissance and exfiltrated system information to a webhook.site URL. The package appears to be a dependency-confusion probe or reconnaissance attack, with the legitimate index.js containing only a trivial Vue button component.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or build system that installed @catamania/front-components from the public npm registry
Ecosystems
npm
Attack vectors
Compromised packageDependency confusion
Affected entities
  • @catamania/front-componentsnpm package containing malicious postinstall.js

The npm package @catamania/front-components was found to contain malicious code that executed automatically during installation. The postinstall.js script collected sensitive host reconnaissance data including the system hostname, current user information, working directory, and environment variable names, then transmitted this data via HTTPS POST to a hardcoded webhook.site URL (webhook.site/4b333dc6-9783-4f6b-82fa-db9795caa938).

While environment variable values were masked, the exfiltration of key names and host identifiers meant that each installation would leave identifying information about the installer's machine. The package's actual functionality—a trivial 5-line Vue button component in index.js—did not match the malicious install-time behavior, suggesting this was either a scoped dependency-confusion attack or a reconnaissance probe to identify which internal build hosts resolve the @catamania scope to the public registry.

The malicious package was identified by Amazon Inspector and credited to the OpenSSF's malicious-packages repository. This incident demonstrates the risk of typosquatting and dependency-confusion attacks targeting internal or scoped package namespaces.

Indicators of compromise

Packages
  • @catamania/front-components
Domains
  • webhook.site

Remediation

  • Immediately remove @catamania/front-components from all package.json files and lock files
  • Audit npm install logs and CI/CD build logs to identify all systems that installed this package
  • Review webhook.site/4b333dc6-9783-4f6b-82fa-db9795caa938 access logs if available to determine what data was exfiltrated
  • Rotate credentials and secrets that may have been exposed via environment variable names or host identifiers
  • Implement npm package scanning and verification in CI/CD pipelines to detect malicious postinstall scripts
  • Use npm audit and tools like Snyk to monitor for similar malicious packages
  • Consider using private npm registries or package allowlists to prevent dependency-confusion attacks

Sources

  1. GitHub Advisory GHSA-j897-68x3-2658 · GitHub Advisory Database

Cite this entry

"Malicious code in @catamania/front-components (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-catamania-front-components-npm-7ot9wd

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion
  4. resolvedcritical

    Malicious code in @gfe/lx-watcher (npm)

    The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.

    npmDependency confusionCompromised package