Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in depcruise-baseline (npm)

The npm package depcruise-baseline version 99.9.1 was identified as malicious by the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activity.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Unknown; depends on adoption of version 99.9.1
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • depcruise-baseline · 99.9.1

The OpenSSF Package Analysis project identified depcruise-baseline version 99.9.1 on npm as containing malicious code. The malicious behavior was detected through analysis of the package's runtime communications.\n\nThe package was found to communicate with a domain associated with malicious activity, indicating potential data exfiltration, command-and-control communication, or other harmful behavior.\n\nThis incident was disclosed on 2026-08-15 and credited to the OpenSSF malicious-packages repository. The affected version is 99.9.1.

Indicators of compromise

Packages
  • depcruise-baseline@99.9.1

Remediation

  • Remove depcruise-baseline version 99.9.1 from all environments
  • Audit project dependencies for any use of depcruise-baseline@99.9.1
  • Review package.lock or yarn.lock files to identify affected installations
  • If depcruise-baseline is required, use only versions prior to 99.9.1 after verification
  • Monitor systems that may have executed code from this package for signs of compromise

Sources

  1. GitHub Advisory GHSA-944r-8f8q-66p7 · GitHub Advisory Database

Cite this entry

"Malicious code in depcruise-baseline (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 15, 2026; last updated August 15, 2026. https://supplychainattack.org/incident/malicious-code-in-depcruise-baseline-npm-n80hvk

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in @syncraft-labs/vue (npm)

    The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.

    npmCompromised package
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. activecritical

    Malware in @sdgdfgdfhhhfd/multiviewr

    Malware discovered in the npm package @sdgdfgdfhhhfd/multiviewr. Systems with this package installed are considered fully compromised and require immediate remediation.

    npmCompromised package
  4. containedcritical

    Malicious code in 3-buildsight-web (npm)

    The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.

    npmCompromised package