Malicious code in fund-calculator (npm)
Malicious npm package fund-calculator (version 999.9.12) contained a preinstall script that collected system and project metadata from installers and exfiltrated it via HTTP, HTTPS, and DNS to a hardcoded callback domain. The package was designed as a dependency-confusion attack to shadow an internal private package.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installs fund-calculator via npm
- Ecosystems
- Attack vectors
- Affected entities
- fund-calculator · 999.9.12
The fund-calculator npm package version 999.9.12 contained malicious code in a preinstall script that executed unconditionally during npm install. The script collected sensitive installer-side information including hostname, user information, current working directory, home directory, and the parent project's package.json metadata (name, author, repository, homepage).
The malicious script also resolved the installer's public IP address by making requests to external services (api.ipify.org, icanhazip.com, ifconfig.me). The collected data was then exfiltrated to a hardcoded callback domain da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun using three separate channels: HTTP POST on port 80, HTTPS POST on port 443 at path /poc/${uuid}, and DNS resolution of hex-encoded payload chunks split into 60-character subdomain labels to bypass egress filters.
The package name and version number (999.9.12) are consistent with a dependency-confusion attack designed to win resolution against a private internal package of the same name. The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- fund-calculator
- Domains
- da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun
- api.ipify.org
- icanhazip.com
- ifconfig.me
Remediation
- Immediately uninstall fund-calculator from all systems and projects
- Audit npm install logs and CI/CD pipelines for any installations of fund-calculator version 999.9.12
- Review system and project metadata that may have been exposed (hostname, usernames, IP addresses, project details)
- Implement package name allowlisting or private registry policies to prevent dependency-confusion attacks
- Monitor for suspicious outbound connections to the callback domain and related infrastructure
- Consider using npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-2qjv-462j-82h3 · GitHub Advisory Database
Cite this entry
"Malicious code in fund-calculator (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 24, 2026; last updated August 24, 2026. https://supplychainattack.org/incident/malicious-code-in-fund-calculator-npm-1ok8po
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in amundi-compare (npm)
Malicious npm package amundi-compare@999.9.12 published at an inflated version number as a dependency-confusion attack. The package executes a preinstall hook that exfiltrates system and project metadata via HTTP, HTTPS, and DNS covert channels to da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun.
npmCompromised packageDependency confusion - activecritical
Malicious code in sm-billing-form (npm)
Malicious npm package sm-billing-form (versions 99.0.0 and 99.0.1) contains preinstall and postinstall lifecycle scripts that execute curl commands to a hardcoded IP address (16.192.173.5) over cleartext HTTP, exfiltrating install environment details. The high version number and behavior pattern indicate a dependency-confusion attack targeting internal packages of the same name.
npmCompromised packageDependency confusion - containedcritical
Malicious code in sm-cart (npm)
Malicious npm package sm-cart (versions 99.0.0 and 99.0.1) uses dependency confusion and preinstall/postinstall scripts to beacon to a hardcoded IP address (16.192.173.5) over plain HTTP, disclosing the installing host's public IP and successful installation. The package is designed to win resolution when an organization has an internal package with the same name.
npmDependency confusionCompromised package - containedcritical
Malicious code in sm-admin (npm)
Malicious npm package sm-admin versions 99.0.0 and 99.0.1 contained preinstall and postinstall lifecycle scripts that made plain-HTTP GET requests to attacker-controlled endpoints, exfiltrating installer IP addresses and probing for private registry usage.
npmCompromised packageDependency confusion