Malicious code in dpdgroup-css (npm)
The npm package dpdgroup-css contained malicious code that executed on installation, exfiltrating the installer's hostname to an external IP address. The package name mimics an internal DPDgroup scope, suggesting a dependency-confusion attack targeting the courier organization.
- Disclosed
- Last updated
- Blast radius
- Any organization that installed dpdgroup-css via npm, particularly those with internal DPDgroup-related build systems or dependencies.
- Ecosystems
- Attack vectors
- Affected entities
- dpdgroup-cssnpm package containing malicious setup.js
The npm package dpdgroup-css was published with malicious code designed to execute during installation. The package.json declared both preinstall and postinstall lifecycle hooks that automatically ran node setup.js on every npm install.
The setup.js script performed reconnaissance by reading the installer's machine hostname via os.hostname() and then issued an HTTP GET request to a hardcoded bare-IP callback at http://89.116.25.133:4444/dpdgroup-css/. The hostname was also transmitted in an X-PoC-Host header, exfiltrating the internal build-host identifier to an external, non-first-party endpoint.
The package name dpdgroup-css closely resembles an internal scope for the DPDgroup courier organization, consistent with a dependency-confusion attack pattern where a private internal build would resolve to this public malicious version instead of the intended internal package. No legitimate library functionality was present in the package.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- dpdgroup-css
- IPs
- 89.116.25.133
Remediation
- Immediately uninstall dpdgroup-css from all systems and environments
- Audit npm install logs and package-lock.json files to identify when and where dpdgroup-css was installed
- Assume any machine that installed this package had its hostname exfiltrated; review access logs and network traffic from the callback IP 89.116.25.133 during the installation window
- Implement dependency-confusion protections: use npm scopes for internal packages, configure .npmrc to prioritize private registries, and use npm audit to detect suspicious packages
- Review and strengthen npm package naming conventions to avoid confusion with internal package names
- Monitor for any suspicious activity originating from or targeting systems that installed the package
Sources
- GitHub Advisory GHSA-pccr-p7j6-phph · GitHub Advisory Database
Cite this entry
"Malicious code in dpdgroup-css (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dpdgroup-css-npm-p9csjq
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - containedcritical
Malicious code in @polymarkets/clob-client-v2 (npm)
@polymarkets/clob-client-v2 (npm) is a malicious package that typosquats the legitimate @polymarket scope and redirects its inquirer dependency to a lookalike npm registry (registrynpmjs.to) to deliver arbitrary code execution during installation and on first require.
npmTyposquattingCompromised packageDependency confusion - containedcritical
Malicious code in @mexc/shared-utils (npm)
Malicious package @mexc/shared-utils published to npm without scope ownership, exploiting dependency-confusion to execute arbitrary code via postinstall hook. The payload collects host metadata and demonstrates install-time code execution against CI/build systems.
npmDependency confusionCompromised package