Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in fastly-vcl-language-client (npm)

The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or CI/CD system that installed fastly-vcl-language-client from npm
Ecosystems
npm
Attack vectors
Compromised packageDependency confusion
Affected entities
  • fastly-vcl-language-clientnpm package containing malicious preinstall script

The npm package fastly-vcl-language-client was published with malicious code embedded in a preinstall script (vishu.js) that executes unconditionally during package installation. The script collects sensitive information including the installer's public IP address (via api.ipify.org), system hostname, and CI/CD environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID, GITHUB_RUN_NUMBER, GITHUB_RUN_ATTEMPT).

The collected data is exfiltrated via HTTP POST/GET requests to a hardcoded webhook.site endpoint (https://webhook.site/3c201be4-c16d-4e0c-bf9c-ccc50faa8574). Additionally, the script performs DNS lookups to exfiltrate the hostname via out-of-band DNS queries.

The package declares itself as a 'dependency test utility package' and its name closely resembles an internal Fastly tool, consistent with a dependency-confusion attack designed to probe build systems that may resolve internal package names against the public npm registry.

The package ships no legitimate functionality and was identified by the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • fastly-vcl-language-client
Domains
  • webhook.site
  • api.ipify.org

Remediation

  • Immediately uninstall fastly-vcl-language-client from all systems and CI/CD pipelines
  • Audit npm package.json files and lock files for any references to fastly-vcl-language-client
  • Review CI/CD logs and environment variable access for the time period when the package may have been installed
  • Rotate any credentials or secrets that may have been exposed through CI environment variables
  • Implement package name allowlisting or verification to prevent dependency-confusion attacks
  • Monitor for suspicious outbound connections to webhook.site or similar data exfiltration endpoints

Sources

  1. GitHub Advisory GHSA-c94r-gh3m-qm4g · GitHub Advisory Database

Cite this entry

"Malicious code in fastly-vcl-language-client (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 15, 2026; last updated August 15, 2026. https://supplychainattack.org/incident/malicious-code-in-fastly-vcl-language-client-npm-11gmtr

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion
  4. resolvedcritical

    Malicious code in @gfe/lx-watcher (npm)

    The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.

    npmDependency confusionCompromised package