Malicious code in greatcall-customers-commandapi (npm)
greatcall-customers-commandapi@99.0.0 is a dependency-confusion attack package that executes malicious code during npm install, collecting system information, credentials, and environment variables, then exfiltrating them to a remote webhook.
- Disclosed
- Last updated
- Blast radius
- Any organization using npm without private registry protections or dependency pinning; affects build and runtime environments where the package is installed.
- Ecosystems
- Attack vectors
- Affected entities
- greatcall-customers-commandapi · 99.0.0
greatcall-customers-commandapi@99.0.0 on npm is a confirmed malicious package implementing a dependency-confusion attack. The package.json explicitly self-describes as "Dependency confusion PoC" and declares preinstall, install, and postinstall lifecycle scripts that all invoke node index.js.
Upon installation, the malicious code collects sensitive host and environment data, including hostname, user information, home directory, platform, current working directory, and network interfaces. It also executes system commands (whoami and ls -la) via child_process.execSync to capture additional context.
The package enumerates all environment variables and filters for credential-shaped keys matching patterns for API keys, secrets, tokens, passwords, authentication credentials, and cloud provider credentials (AWS, Azure, GCP, GitHub, NPM, database, webhook, CI/CD systems). The collected payload is then POSTed to a hardcoded webhook endpoint at https://test.v3n.my/pwn via HTTPS.
The use of version 99.0.0 and an internal-sounding package name are characteristic of dependency-confusion attacks designed to override legitimate private registry packages.
Indicators of compromise
- Packages
- greatcall-customers-commandapi@99.0.0
- Domains
- test.v3n.my
Remediation
- Immediately remove greatcall-customers-commandapi@99.0.0 from all environments and dependency manifests
- Audit npm install logs and CI/CD pipelines for any execution of this package
- Rotate all credentials and secrets that may have been exposed (API keys, tokens, passwords, cloud credentials)
- Review environment variables and access logs for any unauthorized activity
- Implement npm registry authentication and use private registries with strict access controls
- Enable npm audit and dependency scanning in CI/CD pipelines
- Consider using npm package lock files and dependency pinning to prevent unexpected package resolution
- Monitor for similar dependency-confusion attacks using package name patterns
Sources
- GitHub Advisory GHSA-78f6-2878-hcp4 · GitHub Advisory Database
Cite this entry
"Malicious code in greatcall-customers-commandapi (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-greatcall-customers-commandapi-npm-bx6c0g
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @assetshop/verify-cli (npm)
The npm package @assetshop/verify-cli contained malicious code in its preinstall hook that collected and exfiltrated system and user information to an external OAST callback domain. The package exhibited the standard dependency-confusion reconnaissance pattern targeting private registries.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in ghazaly (npm)
The npm package ghazaly version 99.9.0 contained malicious code that executed a postinstall hook to collect system information (hostname, current user, IP addresses) and exfiltrate it to a Burp Collaborator domain. The package exhibited dependency-confusion characteristics with a high version number and nonsense dependencies.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in dcfarguscert (npm)
dcfarguscert@999.0.1 on npm contained malicious preinstall and postinstall scripts that collected system and environment information and exfiltrated it via HTTP to a hardcoded endpoint. The package appears to be a dependency-confusion beacon designed to test supply chain vulnerabilities.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in chapters-core (npm)
The npm package chapters-core v9.999.999 contained malicious preinstall/postinstall scripts that collected system and CI/CD environment information and exfiltrated it to an attacker-controlled Interactsh callback domain. The package was shaped as a dependency-confusion attack targeting an internal Samsung package.
npmCompromised packageDependency confusion