Malicious code in greatcall-customers-commandapi (npm)
greatcall-customers-commandapi@99.0.0 is a dependency-confusion attack package that executes malicious code during npm install, collecting system information, credentials, and environment variables, then exfiltrating them to a remote webhook.
- Disclosed
- Last updated
- Blast radius
- Any organization using npm without private registry protections or dependency pinning; affects build and runtime environments where the package is installed.
- Ecosystems
- Attack vectors
- Affected entities
- greatcall-customers-commandapi · 99.0.0
greatcall-customers-commandapi@99.0.0 on npm is a confirmed malicious package implementing a dependency-confusion attack. The package.json explicitly self-describes as "Dependency confusion PoC" and declares preinstall, install, and postinstall lifecycle scripts that all invoke node index.js.
Upon installation, the malicious code collects sensitive host and environment data, including hostname, user information, home directory, platform, current working directory, and network interfaces. It also executes system commands (whoami and ls -la) via child_process.execSync to capture additional context.
The package enumerates all environment variables and filters for credential-shaped keys matching patterns for API keys, secrets, tokens, passwords, authentication credentials, and cloud provider credentials (AWS, Azure, GCP, GitHub, NPM, database, webhook, CI/CD systems). The collected payload is then POSTed to a hardcoded webhook endpoint at https://test.v3n.my/pwn via HTTPS.
The use of version 99.0.0 and an internal-sounding package name are characteristic of dependency-confusion attacks designed to override legitimate private registry packages.
Indicators of compromise
- Packages
- greatcall-customers-commandapi@99.0.0
- Domains
- test.v3n.my
Remediation
- Immediately remove greatcall-customers-commandapi@99.0.0 from all environments and dependency manifests
- Audit npm install logs and CI/CD pipelines for any execution of this package
- Rotate all credentials and secrets that may have been exposed (API keys, tokens, passwords, cloud credentials)
- Review environment variables and access logs for any unauthorized activity
- Implement npm registry authentication and use private registries with strict access controls
- Enable npm audit and dependency scanning in CI/CD pipelines
- Consider using npm package lock files and dependency pinning to prevent unexpected package resolution
- Monitor for similar dependency-confusion attacks using package name patterns
Sources
- GitHub Advisory GHSA-78f6-2878-hcp4 · GitHub Advisory Database
Cite this entry
"Malicious code in greatcall-customers-commandapi (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-greatcall-customers-commandapi-npm-bx6c0g
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in ssb-test-package (npm)
ssb-test-package@1.0.0 on npm contains malicious code designed as a dependency-confusion proof-of-concept. A preinstall hook executes arbitrary code on installation, performing host reconnaissance and writing results to a local file.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in mtslink-depconf-probe-profileusername (npm)
The npm package mtslink-depconf-probe-profileusername contained malicious code designed to probe for internal namespace dependencies and exfiltrate install-time telemetry via DNS lookups to attacker-controlled infrastructure. The package was identified as a dependency-confusion probe targeting internal package namespaces.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package - containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package