Malicious code in dependencyfsdsfdsfg (npm)

The npm package dependencyfsdsfdsfg version 99.9.0 contained malicious code designed to execute automatically upon installation. The package.json file declared a postinstall script that ran node index.js, which would execute without user interaction during npm install.

The index.js script performed reconnaissance by collecting sensitive system information: the installer's username (via whoami), system hostname, current working directory, and non-internal IPv4 addresses from network interfaces. This data was then exfiltrated via HTTPS GET requests to the hardcoded endpoint https://xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com, a Burp Collaborator out-of-band interaction domain used for testing and data exfiltration.

The package metadata strongly suggests this was a dependency-confusion probe: the name is gibberish, the version is suspiciously high (99.9.0), and the author, description, and keywords fields were empty. This pattern is typical of reconnaissance attacks designed to test whether internal package managers or development environments would install a malicious package with a similar name to legitimate dependencies.

The incident was identified and credited to the OpenSSF's malicious-packages repository, indicating it was detected and cataloged as part of ongoing supply chain security monitoring.