Malicious code in electrode-ota-ui-app (npm)
Malicious npm package electrode-ota-ui-app version 99.0.1 exploits dependency confusion to target the electrode-io internal package name. The package executes a postinstall script that collects host identifiers, public IP, and geolocation data, then exfiltrates it to a Burp Collaborator endpoint controlled by the attacker.
- Disclosed
- Last updated
- Blast radius
- Any organization using npm dependency resolution that could resolve the public electrode-ota-ui-app package instead of an intended private registry package.
- Ecosystems
- Attack vectors
- Affected entities
- electrode-ota-ui-app · 99.0.1
The electrode-ota-ui-app npm package version 99.0.1 was published as a malicious dependency-confusion attack targeting the internal electrode-io package of the same name. The package uses an inflated version number (99.0.1) to win dependency resolution against a private registry when resolvers are misconfigured or when the private package is unavailable.
Upon installation or require(), the package unconditionally executes a postinstall script that runs index.js. This script calls a collectAndSend() function that gathers sensitive host information including hostname, user information, platform, and OS release via Node.js os module functions. It additionally resolves the installer's public IP address using the ipify service and retrieves geolocation and ISP data via ipapi.co.
All collected data is POSTed as a JSON payload to a hardcoded Burp Collaborator subdomain (https://itfv50wbocctx0j32fyfq8z7uy0ptdn1c.oastify.com/callback) controlled by the package author. The package README self-identifies as a dependency-confusion proof-of-concept, but the callback infrastructure remains active, meaning any system that resolves this public package over the intended private package is compromised and exfiltrates host and network information to the attacker.
The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- electrode-ota-ui-app
- Domains
- itfv50wbocctx0j32fyfq8z7uy0ptdn1c.oastify.com
Remediation
- Immediately remove electrode-ota-ui-app version 99.0.1 from any systems where it was installed
- Audit npm dependency resolution configuration to ensure private packages are prioritized over public registry packages (use .npmrc scoping and private registry configuration)
- Review host identifiers, IP addresses, and network information from affected systems for potential compromise
- Monitor for any suspicious outbound connections to the Burp Collaborator domain or related infrastructure
- Implement package pinning and lock file verification to prevent unexpected version resolution
- Consider using npm audit and supply chain security tools to detect similar dependency-confusion attacks
Sources
- GitHub Advisory GHSA-mxx2-5pvc-7hc9 · GitHub Advisory Database
Cite this entry
"Malicious code in electrode-ota-ui-app (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-electrode-ota-ui-app-npm-tt3bd7
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in ranux-dev (npm)
ranux-dev, an npm package, contained malicious code that substituted a popular WhatsApp library dependency with arbitrary code from an unaffiliated GitHub account. The package was heavily obfuscated and designed to harvest WhatsApp sessions and credentials from installers.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in localize-extract (npm)
localize-extract@1.0.0 on npm contained malicious postinstall code that exfiltrated host identifiers to an attacker-controlled endpoint. The package name resembled @angular/localize, suggesting a dependency-confusion or typosquatting attack.
npmCompromised packageTyposquattingDependency confusion - containedcritical
Malicious code in ranux-cloud (npm)
The npm package ranux-cloud contains malicious code that executes hidden payloads at import time via encrypted blob decryption and obfuscation. Additionally, the package redirects the legitimate @whiskeysockets/baileys dependency to an attacker-controlled GitHub repository, enabling arbitrary code execution during installation.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in gaarf-node-bq (npm)
gaarf-node-bq is a malicious npm package that acts as a dependency-confusion/typosquat canary targeting Google's internal gaarf package. The package's postinstall script collects host metadata and exfiltrates it to an external endpoint without user consent.
npmDependency confusionTyposquattingCompromised package