Malicious code in @dgn-src-click-to-pay-org/srcdcfreleasecert (npm)
Malicious npm package @dgn-src-click-to-pay-org/srcdcfreleasecert v999.0.1 published as a dependency-confusion attack targeting internal build systems. The postinstall hook exfiltrates environment metadata to a hardcoded endpoint, enabling reconnaissance of compromised hosts.
- Disclosed
- Last updated
- Blast radius
- Organizations with internal npm dependencies matching the scoped package name; reconnaissance phase targeting build systems
- Ecosystems
- Attack vectors
- Affected entities
- @dgn-src-click-to-pay-org/srcdcfreleasecert · 999.0.1
The package @dgn-src-click-to-pay-org/srcdcfreleasecert was published to npm at version 999.0.1 with a malicious postinstall hook. The scoped organization name mimics a legitimate payments vendor (Discover/SRC click-to-pay), designed to evoke trust and target organizations with similarly-named internal dependencies.
Upon installation, the postinstall script (scripts/check-env.js) executes and POSTs reconnaissance data to http://16-171-38-148.sslip.io:8080/api/install over plain HTTP. The exfiltrated data includes the package name, version, host platform, architecture, and Node.js version—enabling the attacker to identify which internal build environments were successfully hijacked.
The package body contains only trivial PAN/Luhn validation helpers, masking the malicious intent. The version number 999.0.1 is a sentinel value chosen to outrank legitimate internal versions during npm dependency resolution, ensuring the malicious package is selected when both public and private registries are consulted.
This is a canonical dependency-confusion reconnaissance attack: the squatted scope resolves inside target build systems and the postinstall beacon reports back successful compromises, enabling attacker follow-up against those hosts.
Indicators of compromise
- Packages
- @dgn-src-click-to-pay-org/srcdcfreleasecert
- Domains
- 16-171-38-148.sslip.io
Remediation
- Immediately remove @dgn-src-click-to-pay-org/srcdcfreleasecert from all package.json files and lock files
- Audit npm install logs and CI/CD logs for evidence of this package being installed in build environments
- Review outbound HTTP connections from build systems for requests to 16-171-38-148.sslip.io:8080
- Implement npm registry allow-listing to restrict dependency resolution to trusted registries only
- Use npm audit and supply-chain security tools to detect dependency-confusion attacks
- Consider using npm scopes with private registry enforcement to prevent public scope hijacking
Sources
- GitHub Advisory GHSA-hfmm-qxg4-g578 · GitHub Advisory Database
Cite this entry
"Malicious code in @dgn-src-click-to-pay-org/srcdcfreleasecert (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 11, 2026. https://supplychainattack.org/incident/malicious-code-in-dgn-src-click-to-pay-org-srcdcfreleasecert-npm-1l9xlt
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package - containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion