Malicious code in cewe-npm-cops (npm)
cewe-npm-cops@99.9.9 is a malicious npm package that exfiltrates the installer's machine hostname via DNS to an attacker-controlled out-of-band service. The package uses a high version number (99.9.9) to override internal packages during dependency resolution and executes a preinstall script that leaks system information.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installs cewe-npm-cops@99.9.9
- Ecosystems
- Attack vectors
- Affected entities
- cewe-npm-cops · 99.9.9
cewe-npm-cops@99.9.9 is a malicious npm package designed as a dependency-confusion probe. The package declares a preinstall script that executes preinstall.js, which reads the system hostname via os.hostname() and performs a DNS lookup against zfir3qor582xqvyqm0tdc7xpqgw7ky8n.oastify.com, an attacker-controlled Burp Collaborator (Interactsh) out-of-band service.
Every installation of this package unconditionally exfiltrates the installer's machine hostname to the third-party OOB endpoint at install time. The package version is set to 99.9.9, a maximum-version squat designed to override internal packages of the same name during dependency resolution. The package itself is otherwise hollow, with an empty index.js as the main entry point and a placeholder author field ('Your_HackerOne_Username').
The package was identified by the OpenSSF's malicious-packages project and reported via Amazon Inspector. While framed as a 'harmless PoC', the behavior constitutes active information exfiltration to an attacker-controlled endpoint.
Indicators of compromise
- Packages
- cewe-npm-cops@99.9.9
- Domains
- zfir3qor582xqvyqm0tdc7xpqgw7ky8n.oastify.com
Remediation
- Remove cewe-npm-cops from all package.json files and lock files
- Audit npm install logs and CI/CD logs for any installations of cewe-npm-cops@99.9.9
- Assume any machine that installed this package has had its hostname exposed to the attacker
- Review internal package naming conventions to prevent dependency-confusion attacks
- Use npm audit to scan for this package in existing projects
- Consider using npm package allow-lists or private registries to prevent installation of untrusted packages
Sources
- GitHub Advisory GHSA-823q-q648-p3m6 · GitHub Advisory Database
Cite this entry
"Malicious code in cewe-npm-cops (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-cewe-npm-cops-npm-l7vo2q
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in alelo-services (npm)
alelo-services@99.0.0 on npm contained malicious preinstall and postinstall scripts that harvested and exfiltrated installer credentials, environment variables, and system metadata to a hardcoded IP endpoint. The package appears to be a dependency-confusion attack targeting a private scope.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in alelo-common (npm)
The npm package alelo-common contained malicious code that auto-executed during installation, exfiltrating system information, credentials, and environment variables to a remote IP address. The package name resembled a private scope, consistent with a dependency-confusion attack.
npmCompromised packageDependency confusion