Malicious code in @divineubg/divine (npm)
The npm package @divineubg/divine contained malicious code that establishes a remote command-and-control channel in browser contexts. The package exports a listen() function that subscribes to attacker-controlled ntfy.sh topics, receives JavaScript code via EventSource, and executes it using eval() and new Function(), with results POSTed back to the attacker.
- Disclosed
- Last updated
- Blast radius
- Any application bundling @divineubg/divine receives an embedded remote command-and-control channel in end-user browsers.
- Ecosystems
- Attack vectors
- Affected entities
- @divineubg/divinenpm package containing malicious code in index.js
The npm package @divineubg/divine was found to contain malicious code in its index.js file. The package exports a listen(clientId) function that establishes a persistent connection to attacker-controlled endpoints via EventSource.
The malicious functionality subscribes to https://ntfy.sh/dv-141u30-admin-cmd- and listens for messages with action 'EVAL_CODE'. When such messages are received, the payload is passed directly to eval() and new Function(), executing arbitrary attacker-supplied JavaScript in the loading context. Execution results are then POSTed back to https://ntfy.sh/dv-141u30-admin-status- .
The clientId is a 7-digit value persisted in localStorage as g_live_username. Any application bundling this package ships this remote command-and-control channel to end-user browsers. An attacker who knows or enumerates a client's topic can execute arbitrary JavaScript in that browser and receive results, with no integrity checks, origin restrictions, or user confirmation required.
The incident was identified by the OpenSSF malicious-packages project and credited to Amazon Inspector.
Indicators of compromise
- Packages
- @divineubg/divine
- Domains
- ntfy.sh
Remediation
- Remove @divineubg/divine from all projects immediately
- Audit all applications that may have bundled this package for signs of compromise
- Rotate any credentials or sensitive data that may have been exposed through browser contexts where this package was active
- Review browser history and network logs for connections to ntfy.sh domains
- Consider the compromise of any end-user systems that loaded applications containing this package
Sources
- GitHub Advisory GHSA-w83g-7xwj-mmqx · GitHub Advisory Database
Cite this entry
"Malicious code in @divineubg/divine (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-divineubg-divine-npm-1r37xr
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package