Malicious code in dojo-rn-interview (npm)
dojo-rn-interview@1.0.1 on npm contains malicious code that executes a preinstall script to collect host identifiers and system files, then exfiltrates the data to a Burp Collaborator domain. The package appears designed as a dependency-confusion reconnaissance beacon targeting internal build systems.
- Disclosed
- Last updated
- Blast radius
- Developers and build systems installing dojo-rn-interview@1.0.1
- Ecosystems
- Attack vectors
- Affected entities
- dojo-rn-interview · 1.0.1
The npm package dojo-rn-interview version 1.0.1 was found to contain malicious code that executes during installation. A preinstall script runs index.js when the package is installed via npm install.
The malicious script collects sensitive host identifiers including hostname, user information, home directory path, and DNS server configuration. It also reads system files /etc/passwd and /etc/hosts from the installer's machine, gathering reconnaissance data about the target environment.
The collected data is exfiltrated via HTTPS POST requests to a hardcoded Burp Collaborator subdomain: kqepxa9s4krgw7e7b6f7kufiy943stgi.oastify.com. This infrastructure is typically used for out-of-band data exfiltration and testing.
The package name and behavior are consistent with a dependency-confusion attack targeting internal build systems, designed to identify and profile development environments rather than deploy persistent malware.
Indicators of compromise
- Packages
- dojo-rn-interview@1.0.1
- Domains
- kqepxa9s4krgw7e7b6f7kufiy943stgi.oastify.com
Remediation
- Immediately uninstall dojo-rn-interview@1.0.1 from all systems and build environments
- Audit npm install logs and package-lock.json files to identify if this package was installed
- Review system logs on affected machines for suspicious data exfiltration to the Burp Collaborator domain
- Rotate credentials and SSH keys on any machines where this package was installed
- Implement npm package allow-listing or scanning policies to prevent installation of suspicious packages
- Monitor for similar dependency-confusion attacks targeting your organization's internal package names
Sources
- GitHub Advisory GHSA-m692-78jp-fgq8 · GitHub Advisory Database
Cite this entry
"Malicious code in dojo-rn-interview (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dojo-rn-interview-npm-5gmpmy
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in lumen-pages-community (npm)
lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in @gfe/lx-watcher (npm)
The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.
npmDependency confusionCompromised package