Malicious code in @gfe/lx-watcher (npm)
The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.
- Disclosed
- Last updated
- Blast radius
- Organizations with private @gfe/lx-watcher packages that resolve against the public npm registry; any developer installing the malicious package.
- Ecosystems
- Attack vectors
- Affected entities
- @gfe/lx-watchernpm package with malicious install-time exfiltration
The @gfe/lx-watcher npm package contained malicious code embedded in install-time lifecycle hooks (preinstall, install, postinstall). All three hooks invoked install.js, which automatically POSTed sensitive host metadata—including hostname, OS username, current working directory, timestamp, and hook name—to a hardcoded webhook.site collector at https://webhook.site/df384ffa-1094-4bbf-a202-e8b345b3ed18/gfe.
The exfiltration occurred automatically on npm install without any user consent or configuration. The package's main export was a no-op createWatcher stub, allowing builds that resolved the scoped name to succeed silently while host identifiers were leaked in the background.
This attack exemplifies the dependency-confusion pattern: organizations with private @gfe/lx-watcher packages would have their installations resolve to the public malicious package, leaking host, username, and install-path metadata to the attacker-controlled collector. The combination of the scoped name, no-op stub, and install-time beacon made the attack difficult to detect during normal code review.
The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- @gfe/lx-watcher
- Domains
- webhook.site
Remediation
- Immediately remove @gfe/lx-watcher from all package.json files and lock files
- Audit npm install logs and network traffic for POST requests to webhook.site/df384ffa-1094-4bbf-a202-e8b345b3ed18/gfe during the period the malicious package was installed
- Review host metadata (hostname, username, working directory) that may have been exfiltrated and assess exposure
- If using a private @gfe/lx-watcher package, verify it is properly scoped and authenticated in your npm registry configuration to prevent future dependency confusion
- Implement npm package signature verification and consider using npm audit to detect malicious packages
- Monitor for any suspicious activity on systems where the package was installed
Sources
- GitHub Advisory GHSA-7jmf-xqv3-ggfj · GitHub Advisory Database
Cite this entry
"Malicious code in @gfe/lx-watcher (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 21, 2026; last updated August 21, 2026. https://supplychainattack.org/incident/malicious-code-in-gfe-lx-watcher-npm-123568
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in lumen-pages-community (npm)
lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in gemini-cli-a2a-server (npm)
A malicious npm package named gemini-cli-a2a-server was published to exploit dependency confusion, mimicking a private Google internal component. The postinstall script collected host identifiers and exfiltrated them to a hardcoded external endpoint.
npmDependency confusionCompromised package