Malicious code in cdf-tag-commander-helper (npm)
The npm package cdf-tag-commander-helper@3.6.2 contained malicious code in its preinstall script that executed reconnaissance on the host system. On installation, the script ran whoami and hostname commands, retrieved the machine's public IP, and sent this information to an attacker-controlled out-of-band callback domain, consistent with dependency-confusion targeting.
- Disclosed
- Last updated
- Blast radius
- Any organization or developer that installed cdf-tag-commander-helper@3.6.2 via npm
- Ecosystems
- Attack vectors
- Affected entities
- cdf-tag-commander-helper · 3.6.2
The npm package cdf-tag-commander-helper@3.6.2 was found to contain malicious code embedded in its preinstall lifecycle script. This script executes automatically when the package is installed via npm install.
The malicious preinstall script performs reconnaissance by executing whoami and hostname commands to identify the user and machine name, then retrieves the public IP address of the host via a request to ifconfig.me. All three pieces of information are exfiltrated via a plain-HTTP GET request to a hardcoded out-of-band callback domain (kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun), passed as query parameters.
The package's README falsely claims that the package makes no network requests, directly contradicting the actual behavior of the shipped code. The reconnaissance beacon pattern is consistent with dependency-confusion attacks, where an attacker publishes a malicious package to a public registry to target internal build systems and identify which hosts and user accounts resolve the package name.
The incident was identified and credited to the OpenSSF's malicious-packages project.
Indicators of compromise
- Packages
- cdf-tag-commander-helper
- Domains
- kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun
Remediation
- Immediately uninstall cdf-tag-commander-helper@3.6.2 from all systems and development environments
- Audit npm install logs and package-lock.json files to identify all systems that may have installed the malicious version
- Assume that the attacker has obtained the username, hostname, and public IP of any machine that installed this package; review access logs and network activity from those systems for signs of compromise
- Update to a patched version of cdf-tag-commander-helper if available, or use an alternative package
- Consider implementing npm package pinning and verification practices to prevent installation of unexpected or malicious packages
- Review internal dependency-confusion protections and private npm registry configurations
Sources
- GitHub Advisory GHSA-3cg7-rhc6-g63p · GitHub Advisory Database
Cite this entry
"Malicious code in cdf-tag-commander-helper (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-cdf-tag-commander-helper-npm-1uh302
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in alelo-services (npm)
alelo-services@99.0.0 on npm contained malicious preinstall and postinstall scripts that harvested and exfiltrated installer credentials, environment variables, and system metadata to a hardcoded IP endpoint. The package appears to be a dependency-confusion attack targeting a private scope.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in alelo-common (npm)
The npm package alelo-common contained malicious code that auto-executed during installation, exfiltrating system information, credentials, and environment variables to a remote IP address. The package name resembled a private scope, consistent with a dependency-confusion attack.
npmCompromised packageDependency confusion