Malicious code in cilm-ui-commons (npm)
The npm package cilm-ui-commons contained malicious code in its preinstall hook that exfiltrated host identity data, user information, filesystem paths, DNS configuration, and package.json contents to an external endpoint. The behavior was designed to detect dependency-confusion scenarios and beacon internal infrastructure details.
- Disclosed
- Last updated
- Blast radius
- All npm install operations on cilm-ui-commons; reconnaissance of internal infrastructure for dependency-confusion attacks.
- Ecosystems
- Attack vectors
- Affected entities
- cilm-ui-commonsnpm package with malicious preinstall hook
The npm package cilm-ui-commons contained a malicious preinstall hook that executed on every installation. The hook collected sensitive host and environment data including hostname, username, home directory, current working directory, DNS server list, and the full package.json contents.\n\nThis data was exfiltrated via HTTP POST to a hardcoded external endpoint at https://eogo57c0daum9d3.m.pipedream.net. The malicious code included comments referencing burpcollaborator and Interactsh-style beaconing techniques, indicating the attack was designed to detect dependency-confusion scenarios where private internal package names are inadvertently resolved from the public npm registry.\n\nThe exfiltrated information would reveal the victim's internal infrastructure, user accounts, filesystem layout, network configuration, and internal dependency graph to the attacker controlling the pipedream endpoint. The behavior fired unconditionally on every installation across all affected machines.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project (MAL-2026-13943).
Indicators of compromise
- Packages
- cilm-ui-commons
- Domains
- eogo57c0daum9d3.m.pipedream.net
Remediation
- Immediately uninstall cilm-ui-commons from all systems
- Audit npm install logs to identify all machines that installed the malicious package
- Review exfiltrated data: check for unauthorized access to internal infrastructure details
- Rotate credentials and review access logs for affected user accounts and systems
- Implement npm package verification and integrity checks in your supply chain
- Monitor for dependency-confusion attacks targeting internal package names
- Use npm audit and security scanning tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-fxmj-23mp-f362 · GitHub Advisory Database
Cite this entry
"Malicious code in cilm-ui-commons (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-cilm-ui-commons-npm-fo3fsr
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in svelte-dim-kit
The npm package svelte-dim-kit was found to contain malware, potentially giving attackers full control of affected systems. All systems with this package installed should be considered compromised and secrets/keys rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in stillm4ddpocs-rtest-bravo (npm)
The npm package stillm4ddpocs-rtest-bravo contained malicious code in its preinstall script that automatically executed during installation, collecting system information and internal package metadata and exfiltrating it to a third-party Interactsh collector via HTTPS and DNS tunneling.
npmCompromised package