Malicious code in @hzero-front-ui/hzero-ui (npm)
A malicious npm package @hzero-front-ui/hzero-ui@99.99.99 was published as a scope-lookalike dependency-confusion attack targeting @hzero-front/hzero-ui. The package executed preinstall and install scripts that exfiltrated the installer's username, hostname, working directory, and package name to attacker-controlled subdomains of callback.m0chan.co.uk.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed @hzero-front-ui/hzero-ui@99.99.99 via npm, particularly those with @hzero-front/hzero-ui as a dependency.
- Ecosystems
- Attack vectors
- Affected entities
- @hzero-front-ui/hzero-ui · 99.99.99
The npm package @hzero-front-ui/hzero-ui@99.99.99 was identified as a malicious dependency-confusion attack. The package mimicked the legitimate @hzero-front/hzero-ui package using a scope-lookalike technique, with a placeholder version number, empty author field, and generic description designed to evade detection.
Upon installation, the package's preinstall and install lifecycle scripts automatically executed, base64-encoding and exfiltrating sensitive information about the installer's environment. The encoded payload contained the OS username, hostname, current working directory, and the internal package name that resolved to the malicious package.
The exfiltrated data was sent to attacker-controlled subdomains of callback.m0chan.co.uk using both HTTPS (via curl) and DNS (via nslookup) queries. This dual-channel approach ensured data transmission even if one method was blocked.
The attack was discovered and reported by the OpenSSF's malicious-packages project, which tracks and catalogs known malicious packages across package ecosystems.
Indicators of compromise
- Packages
- @hzero-front-ui/hzero-ui@99.99.99
- Domains
- callback.m0chan.co.uk
Remediation
- Immediately uninstall @hzero-front-ui/hzero-ui@99.99.99 from all systems and projects
- Audit npm install logs and CI/CD pipelines for any installations of this package version
- Rotate credentials and review access logs for any systems where this package was installed
- Verify that legitimate @hzero-front/hzero-ui dependencies are correctly specified in package.json to prevent future dependency-confusion attacks
- Implement npm package verification and allowlisting policies to prevent installation of unexpected scope-lookalike packages
- Monitor for any suspicious network activity or data exfiltration from affected systems
Sources
- GitHub Advisory GHSA-4rw7-83wf-6rcm · GitHub Advisory Database
Cite this entry
"Malicious code in @hzero-front-ui/hzero-ui (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-hzero-front-ui-hzero-ui-npm-18nbsm
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - containedcritical
Malicious code in alelo-auth (npm)
The npm package alelo-auth version 99.0.0 contained malicious preinstall and postinstall scripts that exfiltrated system information, environment variables, and credential files (.env, .npmrc) to an attacker-controlled IP address. The package appears to be a dependency-confusion attack targeting a private 'alelo-*' namespace.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in alelo-services (npm)
alelo-services@99.0.0 on npm contained malicious preinstall and postinstall scripts that harvested and exfiltrated installer credentials, environment variables, and system metadata to a hardcoded IP endpoint. The package appears to be a dependency-confusion attack targeting a private scope.
npmCompromised packageDependency confusion