Malicious code in chapters-core (npm)
The npm package chapters-core v9.999.999 contained malicious preinstall/postinstall scripts that collected system and CI/CD environment information and exfiltrated it to an attacker-controlled Interactsh callback domain. The package was shaped as a dependency-confusion attack targeting an internal Samsung package.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system installing chapters-core v9.999.999
- Ecosystems
- Attack vectors
- Affected entities
- chapters-core · 9.999.999
The npm package chapters-core at version 9.999.999 was published with embedded malicious code designed to execute during package installation. The package name itself was crafted as a dependency-confusion squat of an internal package name.
Upon installation, the package's preinstall/postinstall lifecycle scripts executed a file named poc.js. This script collected sensitive host and build-environment information including the system hostname, username, current working directory, and CI/CD attribution variables (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID, RUNNER_NAME, npm_config_registry, AWS_REGION, JENKINS_URL, and similar).
The collected data was transmitted via DNS lookups and HTTP/HTTPS POST requests to a hardcoded Interactsh callback subdomain: awfhvaksncnsxtcdjvmnhhqbt59dzenf8.oast.fun. The script also wrote a marker file named samsung-depconf-poc.json into the installer's working directory.
The incident was identified and reported by the OpenSSF malicious-packages project. Any claim of research or proof-of-concept labeling does not mitigate the actual behavior of collecting and exfiltrating internal build-environment data to a non-first-party destination.
Indicators of compromise
- Packages
- chapters-core@9.999.999
- Domains
- awfhvaksncnsxtcdjvmnhhqbt59dzenf8.oast.fun
Remediation
- Immediately uninstall chapters-core v9.999.999 from all development and CI/CD environments
- Audit npm install logs and package-lock.json files to identify systems that installed this package
- Rotate any credentials or secrets that may have been exposed through CI/CD environment variables
- Review outbound DNS and HTTP traffic logs for connections to awfhvaksncnsxtcdjvmnhhqbt59dzenf8.oast.fun
- Implement npm package pinning and dependency verification to prevent dependency-confusion attacks
- Use npm audit and supply-chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-f5jm-mx92-p845 · GitHub Advisory Database
Cite this entry
"Malicious code in chapters-core (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 11, 2026. https://supplychainattack.org/incident/malicious-code-in-chapters-core-npm-wxmola
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package - containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion