Malicious code in chromecast-webdriver-cli (npm)
chromecast-webdriver-cli@1.0.0 on npm contains malicious postinstall code that exfiltrates host metadata to a third-party endpoint. The package appears to be a typosquat/dependency-confusion attack mimicking a legitimate upstream tool.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed chromecast-webdriver-cli@1.0.0
- Ecosystems
- Attack vectors
- Affected entities
- chromecast-webdriver-cli · 1.0.0
chromecast-webdriver-cli@1.0.0 published to npm contains a postinstall lifecycle script that automatically executes during package installation. The script collects host metadata including hostname, OS platform, architecture, Node.js version, package name, and npm lifecycle event, then POSTs this data as JSON to a hardcoded third-party endpoint: h77svwt7.instances.poc.jchunt.top at the path /chromecast-webdriver-cli.
The package name mimics a legitimate upstream project (shaka-project/generic-webdriver-server) but has no functional code and no relationship to the original maintainers. The exfiltration occurs without user consent or opt-in, and the destination domain is an anonymous subdomain unrelated to any legitimate project infrastructure.
This is a classic dependency-confusion and typosquatting attack vector, where an attacker publishes a malicious package under a name similar to a legitimate tool to capture installations from users who may mistype or be confused about the correct package name.
The incident was identified and reported by the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- chromecast-webdriver-cli
- Domains
- h77svwt7.instances.poc.jchunt.top
Remediation
- Immediately uninstall chromecast-webdriver-cli@1.0.0 from all systems
- Audit npm install logs to identify any systems that installed this package
- Review network logs for connections to h77svwt7.instances.poc.jchunt.top to identify potential data exfiltration
- If the package was installed, assume host metadata (hostname, OS details, Node version) has been compromised and consider rotating sensitive credentials
- Use npm audit to check for this package in dependency trees
- Implement package name verification and use npm scopes or private registries to prevent typosquat attacks
Sources
- GitHub Advisory GHSA-x95c-hq44-wmp6 · GitHub Advisory Database
Cite this entry
"Malicious code in chromecast-webdriver-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-chromecast-webdriver-cli-npm-1se13m
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package