Malicious code in global-intel (npm)
The npm package global-intel contained malicious code that exfiltrated host identity and system configuration data during installation. A preinstall hook automatically executed index.js on npm install, collecting hostname, user info, DNS configuration, and sensitive files, then POSTing the data to an attacker-controlled domain.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed the malicious version of global-intel
- Ecosystems
- Attack vectors
- Affected entities
- global-intelnpm package containing malicious preinstall hook
The npm package global-intel was found to contain malicious code designed to exfiltrate sensitive system information from infected machines. The package.json declared a preinstall hook that automatically executed index.js whenever the package was installed via npm.\n\nThe malicious index.js script collected host identity and OS files including os.hostname(), os.userInfo(), home directory path, DNS server configuration, /etc/passwd, /etc/hosts, and package metadata. This data was then HTTPS POSTed to a hardcoded out-of-band exfiltration domain: 0gh240ybp2rb80iyzrg4w2o3tuzlncb1.oastify.com (a Burp Collaborator instance).\n\nThe exfiltration occurred automatically as a lifecycle side effect of installation with no user interaction required. The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- global-intel
- Domains
- 0gh240ybp2rb80iyzrg4w2o3tuzlncb1.oastify.com
Remediation
- Immediately uninstall global-intel from all systems where it was installed
- Review npm install logs to identify when the package was installed and on which machines
- Assume compromise of hostname, username, home directory path, DNS configuration, and /etc/passwd / /etc/hosts contents on affected systems
- Rotate credentials and SSH keys on affected systems
- Monitor affected systems for unauthorized access or lateral movement
- Check npm audit and package-lock.json for any installations of global-intel
- Consider using npm package signing verification and private package registries to prevent similar attacks
Sources
- GitHub Advisory GHSA-qv8h-82w5-95gq · GitHub Advisory Database
Cite this entry
"Malicious code in global-intel (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-global-intel-npm-3flc2y
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - activecritical
Malware in bucket-protocol-sdk-v2
Malware discovered in the npm package bucket-protocol-sdk-v2. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in @junofficial/baileys
The npm package @junofficial/baileys contained malware that fully compromised any system with the package installed or running. The malicious package has been identified and removed from distribution.
npmCompromised package - containedcritical
Malware in userbotjs
The npm package userbotjs contained malware that could fully compromise any system on which it was installed. The advisory recommends treating affected systems as fully compromised and rotating all secrets and keys from a different computer.
npmCompromised package