Malicious code in data-format-helper (npm)
The npm package data-format-helper contained malicious code in a postinstall.js script that auto-executes on installation, collecting sensitive environment variables, CI/CD secrets, and cloud credentials, then exfiltrating them to an attacker-controlled domain. The package appears to be a dependency-confusion attack targeting Tencent internal infrastructure.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed the malicious data-format-helper package during the active distribution window.
- Ecosystems
- Attack vectors
- Affected entities
- data-format-helpernpm package containing malicious postinstall.js
The npm package data-format-helper was published with malicious code disguised as a data-formatting utility. The package contained a postinstall.js script that automatically executes when npm install runs, performing unauthorized reconnaissance and credential harvesting.
The malicious script collects system and environment information including hostname, user identity (whoami/id), sudo privileges, process and network state, and GitHub Actions environment variables (GITHUB_TOKEN, GITHUB_REPOSITORY, GITHUB_ACTOR, RUN_ID). It also captures any environment variables matching patterns for API keys and tokens (KEY, TOKEN, SECRET, NPM_TOKEN, AWS_, AZURE, GCP*, GITHUB_TOKEN). All collected data is base64-encoded and exfiltrated via curl to http://pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/ over plain HTTP.
The script additionally probes cloud instance-metadata endpoints for AWS, Aliyun, GCP, and Tencent, forwarding responses to the same attacker-controlled collector. A secondary phase probes an internal hostname (tst.woa.com) and exfiltrates the base64-encoded response body of flag.html, indicating targeted reconnaissance against a specific internal Tencent environment. The benign package metadata and index.js served as cover for the malicious postinstall behavior, consistent with a dependency-confusion attack pattern.
The incident was identified and reported by the OpenSSF malicious-packages project via GitHub Security Advisory GHSA-8x6p-c3wj-g2h5.
Indicators of compromise
- Packages
- data-format-helper
- Domains
- pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com
- tst.woa.com
Remediation
- Immediately uninstall data-format-helper from all systems and CI/CD pipelines
- Rotate all exposed credentials including GitHub tokens, AWS keys, Azure credentials, GCP keys, and NPM tokens
- Audit CI/CD logs and environment variable access for the period when the package was installed
- Review GitHub Actions workflow logs for unauthorized access or exfiltration
- Scan systems for any additional artifacts or persistence mechanisms left by the postinstall script
- Implement package verification and integrity checks in npm install workflows
- Use npm audit and supply chain security tools to detect similar malicious packages
- Consider using private npm registries or package allowlists to prevent dependency-confusion attacks
Sources
- GitHub Advisory GHSA-8x6p-c3wj-g2h5 · GitHub Advisory Database
Cite this entry
"Malicious code in data-format-helper (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-data-format-helper-npm-1qc5zp
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in alelo-services (npm)
alelo-services@99.0.0 on npm contained malicious preinstall and postinstall scripts that harvested and exfiltrated installer credentials, environment variables, and system metadata to a hardcoded IP endpoint. The package appears to be a dependency-confusion attack targeting a private scope.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in alelo-common (npm)
The npm package alelo-common contained malicious code that auto-executed during installation, exfiltrating system information, credentials, and environment variables to a remote IP address. The package name resembled a private scope, consistent with a dependency-confusion attack.
npmCompromised packageDependency confusion