Malicious code in hunterone-build-probe-9210 (npm)
The npm package hunterone-build-probe-9210 contained malicious code that executed automatically via preinstall and postinstall hooks, collecting sensitive system and credential information and exfiltrating it to a third-party webhook endpoint.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed hunterone-build-probe-9210 from npm; exposed secrets include npm registry tokens and AWS ECS task-role credentials.
- Ecosystems
- Attack vectors
- Affected entities
- hunterone-build-probe-9210npm package containing malicious probe.js
The npm package hunterone-build-probe-9210 contained a malicious probe.js script that executed automatically during package installation via preinstall and postinstall hooks defined in package.json.\n\nUpon execution, the script collected sensitive information including hostname, platform, network interfaces, working directory, user ID, process environment variables, /proc/self/environ, filesystem listings, and the contents of ~/.npmrc. Notably, it specifically targeted AWS_CONTAINER_CREDENTIALS_RELATIVE_URI, which exposes the path to fetch task-role AWS credentials.\n\nThe collected data was serialized as JSON and exfiltrated via HTTPS POST request to a hardcoded webhook.site endpoint at https://webhook.site/22508080-b099-4ec3-8ab7-7354af2886a9/buildenv. This exposed installer-owned secrets including npm registry authentication tokens and AWS ECS credential-endpoint variables to an anonymous third-party collector.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- hunterone-build-probe-9210
- Domains
- webhook.site
Remediation
- Immediately uninstall hunterone-build-probe-9210 from all affected systems and CI/CD pipelines
- Rotate all npm registry authentication tokens that may have been exposed
- Rotate or revoke AWS IAM credentials and task-role credentials that may have been exposed
- Audit npm registry access logs for unauthorized activity
- Review ~/.npmrc files on affected systems for unauthorized modifications
- Scan systems for any additional malicious artifacts or persistence mechanisms
- Update npm to the latest version and enable package integrity verification
Sources
- GitHub Advisory GHSA-7vcv-c883-w3f6 · GitHub Advisory Database
Cite this entry
"Malicious code in hunterone-build-probe-9210 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 15, 2026; last updated August 15, 2026. https://supplychainattack.org/incident/malicious-code-in-hunterone-build-probe-9210-npm-17x0z0
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malware in hydration-dim-kit
Malware was discovered in the npm package hydration-dim-kit. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package