Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in @hzero-front-ui/c7n-ui (npm)

Malicious npm package @hzero-front-ui/c7n-ui@99.99.99 was published as a dependency-confusion attack, using preinstall and install hooks to exfiltrate host reconnaissance data (whoami, hostname, working directory, package name) to attacker-controlled infrastructure via HTTPS and DNS channels.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or CI/CD system that installed @hzero-front-ui/c7n-ui@99.99.99, particularly those with internal package registries using the @hzero-front-ui scope.
Ecosystems
npm
Attack vectors
Dependency confusion
Affected entities
  • @hzero-front-ui/c7n-ui · 99.99.99

The package @hzero-front-ui/c7n-ui@99.99.99 was published to npm as a malicious dependency-confusion attack. The scoped package name mimics an internal package naming convention, and the version number 99.99.99 was chosen to win dependency resolution against legitimate internal registries.

The package contains no legitimate functionality. Instead, preinstall and install lifecycle hooks in package.json execute reconnaissance code that collects the installer's identity information: whoami, hostname, current working directory, and the package name itself. This data is base64-encoded and concatenated.

The exfiltration uses a dual-channel approach designed to bypass egress filtering: HTTPS GET requests to https://.callback.m0chan.co.uk and DNS lookups on subdomains of the same host. This redundancy ensures data reaches the attacker even if one channel is blocked.

Installation of this package automatically triggers host reconnaissance data exfiltration. The attack was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.

Indicators of compromise

Domains
  • callback.m0chan.co.uk

Remediation

  • Immediately remove @hzero-front-ui/c7n-ui@99.99.99 from all package.json files and lock files
  • Audit npm install logs and CI/CD logs for evidence of installation of version 99.99.99
  • If installed, assume host reconnaissance data was exfiltrated; review network logs for connections to callback.m0chan.co.uk
  • Regenerate credentials and secrets that may have been accessible from affected machines
  • Verify that internal package registries are properly configured to prevent dependency-confusion attacks
  • Use npm audit or similar tools to detect and prevent installation of this package

Sources

  1. GitHub Advisory GHSA-87j4-2mgq-7prq · GitHub Advisory Database

Cite this entry

"Malicious code in @hzero-front-ui/c7n-ui (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-hzero-front-ui-c7n-ui-npm-1qi83s

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  2. resolvedcritical

    Malicious code in stillm4ddpocs-rtest-alpha (npm)

    The npm package stillm4ddpocs-rtest-alpha (version 999.9.9) contained malicious code that executed a preinstall hook to exfiltrate system and project metadata without user consent. The package used multiple covert channels (HTTP, HTTPS, and DNS TXT queries) to transmit collected data to a hardcoded callback domain, with DNS encoding designed to bypass egress filtering.

    npmDependency confusion
  3. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  4. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion