Malicious code in @hzero-front-ui/cfg (npm)
Malicious npm package @hzero-front-ui/cfg version 99.99.99 contained preinstall and install lifecycle scripts that exfiltrated system information (whoami, hostname, working directory, package name) to attacker-controlled subdomains of callback.m0chan.co.uk via HTTPS and DNS queries. The package pattern and version number indicate a dependency-confusion attack targeting internal @hzero-front-ui scoped packages.
- Disclosed
- Last updated
- Blast radius
- Any organization with @hzero-front-ui/cfg in their npm dependency tree, particularly those with internal @hzero-front-ui scoped packages.
- Ecosystems
- Attack vectors
- Affected entities
- @hzero-front-ui/cfg · 99.99.99
The npm package @hzero-front-ui/cfg version 99.99.99 was published with malicious lifecycle scripts in package.json. Upon installation via npm install, the preinstall and install hooks executed commands that collected system reconnaissance data including the output of whoami, hostname, current working directory, and the npm package name.
The collected data was base64-encoded and transmitted to the attacker via two channels: an HTTPS GET request to subdomains of callback.m0chan.co.uk (using curl) and a DNS lookup query against subdomains of the same domain (using nslookup). This dual-channel exfiltration ensured data transmission even if one channel was blocked.
The package name pattern (@hzero-front-ui scope) combined with the unusually high version number (99.99.99) are consistent with a dependency-confusion attack designed to target organizations with internal @hzero-front-ui scoped packages. When a developer or CI/CD system attempts to install a private internal package, a public package with a higher version number on npm may be installed instead if scope resolution is misconfigured.
The malicious package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- @hzero-front-ui/cfg
- Domains
- callback.m0chan.co.uk
Remediation
- Immediately remove @hzero-front-ui/cfg from all package.json files and lock files
- Audit npm install logs and CI/CD logs for any installations of @hzero-front-ui/cfg version 99.99.99
- Assume any system that installed this package has been compromised; rotate credentials (SSH keys, API tokens, passwords) for affected systems
- Review network logs for outbound HTTPS connections to callback.m0chan.co.uk and DNS queries to subdomains of that domain
- Implement npm scope verification and dependency-confusion protections (e.g., npm token scoping, private registry configuration)
- Monitor for similar high-version-number packages in public registries targeting internal scopes
Sources
- GitHub Advisory GHSA-xw5r-5p6j-q25p · GitHub Advisory Database
Cite this entry
"Malicious code in @hzero-front-ui/cfg (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-hzero-front-ui-cfg-npm-fzimq8
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - containedcritical
Malicious code in @mexc/shared-utils (npm)
Malicious package @mexc/shared-utils published to npm without scope ownership, exploiting dependency-confusion to execute arbitrary code via postinstall hook. The payload collects host metadata and demonstrates install-time code execution against CI/build systems.
npmDependency confusionCompromised package - containedcritical
Malicious code in @polymarkets/clob-client-v2 (npm)
@polymarkets/clob-client-v2 (npm) is a malicious package that typosquats the legitimate @polymarket scope and redirects its inquirer dependency to a lookalike npm registry (registrynpmjs.to) to deliver arbitrary code execution during installation and on first require.
npmTyposquattingCompromised packageDependency confusion