Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in depcruise-fmt (npm)

The npm package depcruise-fmt version 99.9.1 was identified as malicious by the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activity.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Unknown; depends on adoption of version 99.9.1
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • depcruise-fmt · 99.9.1

The OpenSSF Package Analysis project identified depcruise-fmt version 99.9.1 on npm as containing malicious code. The malicious behavior was detected through analysis of the package's network communications.\n\nThe package was found to communicate with a domain associated with malicious activity, indicating potential data exfiltration, command-and-control communication, or other harmful behavior.\n\nThis incident was disclosed on 2026-08-15 and credited to the OpenSSF malicious-packages repository. The specific malicious package hash is ea193e6cea73a06c8f92a684d56040564d6a0fef93da1d45010978107ea0fd0c.

Indicators of compromise

Packages
  • depcruise-fmt@99.9.1

Remediation

  • Remove depcruise-fmt version 99.9.1 from all environments
  • Audit systems that installed or executed this package version for signs of compromise
  • Review network logs for connections to the malicious domain
  • Update to a safe version of depcruise-fmt if available, or use an alternative package
  • Check npm audit and security scanning tools for detection of this package in your dependency tree

Sources

  1. GitHub Advisory GHSA-29c8-59h2-f6pq · GitHub Advisory Database

Cite this entry

"Malicious code in depcruise-fmt (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 15, 2026; last updated August 15, 2026. https://supplychainattack.org/incident/malicious-code-in-depcruise-fmt-npm-1yap4x

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in 3-buildsight-web (npm)

    The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.

    npmCompromised package
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in create-coin (npm)

    create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.

    npmCompromised packageTyposquatting
  4. resolvedcritical

    Malicious code in @syncraft-labs/vue (npm)

    The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.

    npmCompromised package