Malicious code in @demopack/www (npm)
The npm package @demopack/www contained malicious code disguised as static assets. The package loaded external JavaScript and delivered a hidden iframe to iOS users (versions 15.2–17.x), implementing a browser-side exploit chain with in-code comments describing sandbox evasion and attack code execution.
- Disclosed
- Last updated
- Blast radius
- Any website integrating @demopack/www as a static asset dependency; end-users visiting those sites from iOS devices (iOS 15.2–17.x).
- Ecosystems
- Attack vectors
- Affected entities
- @demopack/wwwnpm package containing malicious iOS-targeted exploit chain
The npm package @demopack/www was published with malicious intent, masquerading as a static assets distribution library. Analysis revealed that the shipped HTML and JavaScript files implement a sophisticated iOS-targeted attack chain rather than legitimate static content.\n\nThe malicious behavior is multi-staged: js/index.js unconditionally injects a script tag loading code from https://cdn.jsdelivr.net/npm/@cdnshell/loader/a188ps10.js (an unrelated npm scope) without integrity verification. 01_iframe.js gates on iOS user-agent detection and injects a hidden 0×0 iframe pointing to https://unpkg.com/@themepack/dark/ah3zhsl.html?t= (another unrelated scope). 02_probe.js fingerprints the iOS build number and selects version-specific attack "lanes" for iOS 15.2–17.x, executed within a Worker context. Code comments in Chinese explicitly reference primitive injection, sandbox status, and running attack code via Worker.\n\nThe attack silently ignores non-iOS visitors while delivering the exploit chain to iOS users. The publisher scope (@demopack) is unrelated to the scopes hosting the loaded payloads (@cdnshell, @themepack), indicating a coordinated multi-package attack. Any developer integrating @demopack/www into their website would unknowingly serve this drive-by exploit to their iOS-using visitors.\n\nThe package contains no lifecycle scripts, so the harm is not to npm installers but to end-users visiting websites that ship these assets. The stated purpose (static assets distribution) was a cover story for browser-side exploit delivery.
Indicators of compromise
- Packages
- @demopack/www
- @cdnshell/loader
- @themepack/dark
- Domains
- cdn.jsdelivr.net
- unpkg.com
Remediation
- Immediately remove @demopack/www from all dependencies and rebuild/redeploy affected websites
- Audit all websites that integrated @demopack/www for signs of compromise or malicious activity
- Review iOS user access logs for the affected sites during the package's availability window
- Implement Subresource Integrity (SRI) checks on all external script and iframe loads
- Use Content Security Policy (CSP) to restrict script loading to trusted origins only
- Monitor for related malicious packages in the @cdnshell and @themepack scopes
Sources
- GitHub Advisory GHSA-g447-2pwf-9jh2 · GitHub Advisory Database
Cite this entry
"Malicious code in @demopack/www (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-demopack-www-npm-8uxarp
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package