Malicious code in @design-system-coopeuch/web (npm)
@design-system-coopeuch/web versions 999.0.4 and 999.0.0 on npm contained malicious code implementing a dependency-confusion attack. The package included a preinstall hook that exfiltrated host identifiers (hostname, working directory, user ID, environment variables) to a hardcoded IP address via cleartext HTTP.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed @design-system-coopeuch/web@999.0.4 or @design-system-coopeuch/web@999.0.0 from npm without a private registry override.
- Ecosystems
- Attack vectors
- Affected entities
- @design-system-coopeuch/web · 999.0.4, 999.0.0
The npm package @design-system-coopeuch/web published versions 999.0.4 and 999.0.0 as a dependency-confusion attack targeting an internal-looking scoped package. The inflated version number (999.x) was designed to override any private registry copy when installed.
The package.json declared a preinstall hook executing cb.js, which automatically ran on npm install without user consent. This script collected sensitive host identifiers including os.hostname(), current working directory, install directory, user ID (id command), system information (uname -a), OS release details, and the full list of process.env key names.
The collected data was exfiltrated via an unencrypted HTTP POST request to http://157.173.126.113:8443/dep-confusion. Although the package description claimed to be an "authorized bug bounty PoC," any unintended installer had their host fingerprint sent to an attacker-controlled endpoint.
The attack was identified by both Amazon Inspector and the OpenSSF Package Analysis project as malicious due to the combination of internal-scope impersonation, inflated versioning, and install-time data exfiltration.
Indicators of compromise
- Packages
- @design-system-coopeuch/web@999.0.4
- @design-system-coopeuch/web@999.0.0
- IPs
- 157.173.126.113
Remediation
- Immediately uninstall @design-system-coopeuch/web from all systems and projects
- Audit npm install logs and CI/CD pipelines for any installation of versions 999.0.0 or 999.0.4
- Assume any host that installed this package has been fingerprinted; review access logs and network activity from affected systems during the installation window
- Implement npm registry pinning and private registry configuration to prevent dependency-confusion attacks
- Use npm audit and supply-chain security tools to detect similar malicious packages
- Review and rotate credentials or secrets that may have been exposed on affected systems
Sources
- GitHub Advisory GHSA-4fqj-2fv5-gj83 · GitHub Advisory Database
Cite this entry
"Malicious code in @design-system-coopeuch/web (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-design-system-coopeuch-web-npm-17u6sz
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @pelmnaads/naads-common-logger (npm)
Malicious code in @pelmnaads/naads-common-logger (npm) version 19999.0.1 exploited dependency confusion by publishing to the public npm registry with an abnormally high version number. A preinstall script transmitted installer hostname data to a Burp Collaborator endpoint (h5nvwrz2815ubw84cpkwhezm5db9z1nq.b.mburpcollab.com), silently exfiltrating build host identity.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in @convera/ui-shared (npm)
The npm package @convera/ui-shared version 0.0.2 contained malicious code that exfiltrated system hostname and username during installation via a preinstall script. The package was published under a private namespace scope, creating a dependency-confusion attack surface against the Convera organization.
npmCompromised packageDependency confusion - containedcritical
Malicious code in secdriven (npm)
The npm package 'secdriven' version 1.0.8 contains malicious postinstall code that exfiltrates host identity, username, working directory, and CI environment variables to a third-party OOB-detection endpoint. The package is a dependency-confusion payload targeting Google's internal namespace, masquerading as a security research canary.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in @webapp-next/store (npm)
The npm package @webapp-next/store contained malicious code that executed automatically on installation, collecting system and user information and exfiltrating it to an attacker-controlled server. The package had no legitimate functionality and used a dependency-confusion lure with a scope resembling a legitimate namespace.
npmCompromised packageDependency confusion