Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in content-common (npm)

Malicious code was published in content-common@99.9.9 on npm. The package contained a preinstall script that executed arbitrary code via HTTP GET to an attacker-controlled Burp Suite Collaborator endpoint, leaking installer IP and DNS metadata. The version number suggests a dependency-confusion probe against an internal package.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or CI/CD system that installed content-common@99.9.9
Ecosystems
npm
Attack vectors
Compromised packageDependency confusion
Affected entities
  • content-common · 99.9.9

The npm package content-common version 99.9.9 contained malicious code in its preinstall lifecycle script. The script executed node -e to perform an HTTP GET request to a unique subdomain of oastify.com (a Burp Suite Collaborator instance), specifically http://fyhmr907kt8qphysiu67m1p00r6iu8ix.oastify.com.

This malicious script executed automatically upon npm install, triggering arbitrary code execution on the installer's host machine. The HTTP request leaked the installer's public IP address and DNS resolver metadata via the unique subdomain lookup to the attacker-controlled endpoint.

The package was framed as a 'Mozilla bug bounty PoC', but this did not prevent the malicious behavior from executing on any consumer installation. The unusually high version number (99.9.9) is consistent with a dependency-confusion or typosquatting probe targeting an internal package name.

The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • content-common@99.9.9
Domains
  • oastify.com
  • fyhmr907kt8qphysiu67m1p00r6iu8ix.oastify.com

Remediation

  • Remove content-common@99.9.9 from all environments immediately
  • Audit npm install logs and CI/CD pipelines for any installations of content-common@99.9.9
  • Assume any host that installed this version may be compromised; review for unauthorized access or data exfiltration
  • Use npm audit to identify if the package was installed as a transitive dependency
  • Implement package pinning and lock file verification to prevent installation of unexpected versions
  • Monitor for similar dependency-confusion attacks targeting internal package names

Sources

  1. GitHub Advisory GHSA-2g4v-xv3f-9gv3 · GitHub Advisory Database

Cite this entry

"Malicious code in content-common (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-content-common-npm-vp0ek8

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion
  4. resolvedcritical

    Malicious code in @gfe/lx-watcher (npm)

    The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.

    npmDependency confusionCompromised package