Malicious code in ghazaly (npm)
The npm package ghazaly version 99.9.0 contained malicious code that executed a postinstall hook to collect system information (hostname, current user, IP addresses) and exfiltrate it to a Burp Collaborator domain. The package exhibited dependency-confusion characteristics with a high version number and nonsense dependencies.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed ghazaly version 99.9.0 via npm.
- Ecosystems
- Attack vectors
- Affected entities
- ghazaly · 99.9.0
The npm package ghazaly version 99.9.0 was found to contain malicious code designed to execute during installation. A postinstall hook in package.json triggered index.js, which imported Node.js modules for system interaction (os, https, child_process).
The malicious script executed the whoami command via execSync and collected system metadata including hostname, current working directory, and non-internal IPv4 addresses from os.networkInterfaces(). This information was then exfiltrated via an HTTPS GET request to a hardcoded Burp Collaborator subdomain (xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com) as query-string parameters.
The package metadata suggested a dependency-confusion attack: version 99.9.0 (artificially high), empty author/description/keywords fields, and a nonsense dependency name dependencyfsdsfdsfg pinned to ^99.9.0. This pattern is consistent with attempts to trick developers into installing a malicious package in place of an internal or legitimate dependency.
The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- ghazaly
- Domains
- xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com
Remediation
- Immediately uninstall ghazaly version 99.9.0 from all systems and projects
- Audit npm install logs to identify any systems that installed this package
- Assume any system that installed ghazaly 99.9.0 may have been compromised; review system logs for suspicious activity and consider credential rotation
- Review network traffic logs for connections to xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com
- Update npm dependencies to remove any references to ghazaly or the nonsense dependency `dependencyfsdsfdsfg`
- Use npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-2j9m-4gmh-3m8p · GitHub Advisory Database
Cite this entry
"Malicious code in ghazaly (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 11, 2026. https://supplychainattack.org/incident/malicious-code-in-ghazaly-npm-1cnwbn
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - containedcritical
Malicious code in @mexc/shared-utils (npm)
Malicious package @mexc/shared-utils published to npm without scope ownership, exploiting dependency-confusion to execute arbitrary code via postinstall hook. The payload collects host metadata and demonstrates install-time code execution against CI/build systems.
npmDependency confusionCompromised package - containedcritical
Malicious code in @polymarkets/clob-client-v2 (npm)
@polymarkets/clob-client-v2 (npm) is a malicious package that typosquats the legitimate @polymarket scope and redirects its inquirer dependency to a lookalike npm registry (registrynpmjs.to) to deliver arbitrary code execution during installation and on first require.
npmTyposquattingCompromised packageDependency confusion