Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in de-morgan (npm)

The npm package de-morgan contained malicious code that declared a dependency on a non-registry host (http://pack.nppacks.com/npm/de-morgan) served over plain HTTP without version pinning or integrity checks. On installation, npm would fetch and execute arbitrary code from the attacker-controlled URL, bypassing the benign in-tree source code.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any project installing the malicious de-morgan package or packages depending on it
Ecosystems
npm
Attack vectors
Compromised packageDependency confusion
Affected entities
  • de-morgannpm package with malicious dependency pointing to attacker-controlled URL

The de-morgan npm package was found to contain malicious code that exploited npm's dependency resolution mechanism. The package.json declared both dependencies and devDependencies entries pointing to http://pack.nppacks.com/npm/de-morgan, a non-npm-registry host reached over unencrypted HTTP.

When npm install was executed, npm would fetch and install whatever tarball was served from that attacker-controlled URL into the dependency graph, including executing any lifecycle scripts contained within. This allowed arbitrary code execution during installation.

The visible index.js file in the repository was a benign clone of babel-plugin-transform-define with a comment stating "This package use for Security Research Testing Purpose." However, the package manifest wired in the mutable, plaintext delivery URL under a lookalike domain (nppacks.com), meaning the actual installed code was whatever the remote host served at runtime, not the in-tree source.

This incident was identified by the OpenSSF's malicious-packages project and reported via GitHub Security Advisory GHSA-q86w-28ph-gmvv.

Indicators of compromise

Packages
  • de-morgan
Domains
  • pack.nppacks.com

Remediation

  • Remove de-morgan from all project dependencies immediately
  • Audit npm install logs and lock files to identify when the package was installed
  • Review any systems where de-morgan was installed for signs of compromise or unauthorized code execution
  • Use npm audit to check for other malicious packages
  • Implement npm registry integrity checks and consider using npm lockfiles with integrity hashes
  • Monitor for similar lookalike domain attacks (nppacks.com vs npmjs.com)
  • Use tools like npm ci with --prefer-offline to reduce exposure to remote URL fetches

Sources

  1. GitHub Advisory GHSA-q86w-28ph-gmvv · GitHub Advisory Database

Cite this entry

"Malicious code in de-morgan (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-de-morgan-npm-1kx4k5

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  2. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  3. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion
  4. resolvedcritical

    Malicious code in @gfe/lx-watcher (npm)

    The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.

    npmDependency confusionCompromised package