Malicious code in dcfarguscert (npm)
dcfarguscert@999.0.1 on npm contained malicious preinstall and postinstall scripts that collected system and environment information and exfiltrated it via HTTP to a hardcoded endpoint. The package appears to be a dependency-confusion beacon designed to test supply chain vulnerabilities.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed dcfarguscert@999.0.1
- Ecosystems
- Attack vectors
- Affected entities
- dcfarguscert · 999.0.1
dcfarguscert@999.0.1 was published to npm with embedded malicious lifecycle scripts (preinstall and postinstall hooks) that executed src/telemetry.js upon installation. The script collected sensitive host identifiers including hostname, username, OS release, platform, architecture, Node version, and CI environment flags, along with the output of npm ls -g --depth=0 --json to enumerate globally installed packages.\n\nThe collected data was exfiltrated via unencrypted HTTP POST to http://16-171-38-148.sslip.io:8080/api/install (IP 16.171.38.148 encoded via sslip.io). The suspicious version number (999.0.1) and package description referencing 'dependency test' and 'check ips' indicate this was a dependency-confusion beacon designed to fire unconditionally on install without user consent.\n\nThe malicious package was identified by the OpenSSF's malicious-packages project and credited to Amazon Inspector. Any system that installed this version would have had system and package inventory information exfiltrated to the attacker-controlled endpoint.
Indicators of compromise
- Packages
- dcfarguscert@999.0.1
- Domains
- 16-171-38-148.sslip.io
- IPs
- 16.171.38.148
Remediation
- Immediately uninstall dcfarguscert@999.0.1 from all systems and CI/CD pipelines
- Audit npm package.json files and lock files for any references to dcfarguscert
- Review system logs and network traffic from the time of installation for connections to 16.171.38.148 or sslip.io domains
- Rotate credentials and SSH keys on any systems where the package was installed
- Monitor for unauthorized access or lateral movement from affected systems
- Use npm audit to check for other malicious packages
- Consider implementing package signature verification and allowlisting for npm dependencies
Sources
- GitHub Advisory GHSA-mf24-fh58-62x2 · GitHub Advisory Database
Cite this entry
"Malicious code in dcfarguscert (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 11, 2026. https://supplychainattack.org/incident/malicious-code-in-dcfarguscert-npm-8s63hv
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - containedcritical
Malicious code in alelo-utils (npm)
Malicious code in alelo-utils npm package version 99.0.0 exfiltrates system information and credentials during installation. The package uses preinstall and postinstall scripts to collect hostname, username, environment variables, .npmrc tokens, .env files, and cloud credentials, sending them to an attacker-controlled IP address.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in alelo-sdk (npm)
alelo-sdk@99.0.0 on npm contains malicious lifecycle scripts that harvest sensitive environment data (credentials, tokens, secrets) and exfiltrate it to a hardcoded IP endpoint. The package uses dependency confusion tactics targeting a private 'alelo' scope with an inflated version number.
npmCompromised packageDependency confusion