Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in @hzero-front-ui/themes (npm)

Malicious npm package @hzero-front-ui/themes version 99.99.99 was published as a dependency-confusion attack to override a private-registry package. The package contained preinstall and install scripts that exfiltrated system information (whoami, hostname, pwd, package name) to attacker-controlled subdomains of callback.m0chan.co.uk via HTTPS and DNS.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or CI/CD system that installed @hzero-front-ui/themes version 99.99.99 from npm
Ecosystems
npm
Attack vectors
Dependency confusionCompromised package
Affected entities
  • @hzero-front-ui/themes · 99.99.99

A malicious npm package @hzero-front-ui/themes version 99.99.99 was published to the public npm registry as a dependency-confusion attack. The scoped package name combined with an artificially high version number (99.99.99) was designed to override a private-registry package of the same name on any system that resolved the dependency.

The package.json defined preinstall and install lifecycle scripts that executed automatically on npm install. These scripts collected sensitive system information including the installer's username (whoami), hostname, current working directory (pwd), and npm package name, then base64-encoded this data.

The exfiltrated information was beaconed to attacker-controlled infrastructure via two methods: HTTPS GET requests to subdomains of callback.m0chan.co.uk (using curl with a 5-second timeout) and DNS lookups to the same domain. This dual-channel approach increased the likelihood of successful data exfiltration.

The incident was identified and credited to the OpenSSF malicious-packages project, which tracks confirmed malicious packages across ecosystems.

Indicators of compromise

Packages
  • @hzero-front-ui/themes
Domains
  • callback.m0chan.co.uk

Remediation

  • Immediately uninstall @hzero-front-ui/themes version 99.99.99 from all systems and projects
  • Audit npm install logs and CI/CD pipelines to identify any machines that installed this package
  • Assume any system that installed this package may have been compromised; review system logs for suspicious activity during the installation window
  • Rotate credentials and SSH keys on any affected systems
  • Review network logs for outbound connections to callback.m0chan.co.uk and related subdomains
  • Update dependency management policies to use private registries with strict version pinning and scoped package verification
  • Monitor for similar dependency-confusion attacks using high version numbers on scoped packages

Sources

  1. GitHub Advisory GHSA-5wqp-c676-3j8x · GitHub Advisory Database

Cite this entry

"Malicious code in @hzero-front-ui/themes (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-hzero-front-ui-themes-npm-1ezidp

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion
  4. resolvedcritical

    Malicious code in @gfe/lx-watcher (npm)

    The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.

    npmDependency confusionCompromised package