Malicious code in jobber-app-template-react (npm)
The npm package jobber-app-template-react contained malicious code in its preinstall hook that executed automatically on npm install. The script performed host reconnaissance and exfiltrated sensitive system information to a Burp Collaborator domain.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed jobber-app-template-react via npm
- Ecosystems
- Attack vectors
- Affected entities
- jobber-app-template-reactnpm package containing malicious preinstall hook
The npm package jobber-app-template-react was found to contain malicious code in its preinstall hook (index.js) that executed automatically when the package was installed via npm install. The script was unrelated to the package's advertised purpose as a React application template.\n\nThe malicious preinstall script performed host reconnaissance by collecting system information including hostname, username, home directory, DNS servers, and the installation directory (__dirname). It also read sensitive files from the installer's machine, specifically /etc/passwd and /etc/hosts.\n\nThe collected data was then exfiltrated via an HTTPS POST request to a hardcoded Burp Collaborator subdomain (5tzh3l2e1cetr1chf6osh4tg57b0zqnf.oastify.com) as a JSON payload. This behavior is characteristic of a dependency-confusion attack used for reconnaissance and data exfiltration.\n\nThe incident was identified and reported through the OpenSSF malicious packages database (MAL-2026-11137).
Indicators of compromise
- Packages
- jobber-app-template-react
- Domains
- 5tzh3l2e1cetr1chf6osh4tg57b0zqnf.oastify.com
Remediation
- Immediately uninstall jobber-app-template-react from all systems and CI/CD pipelines
- Review npm install logs and audit trails for any installations of jobber-app-template-react
- Assume compromise of any system that installed this package; rotate credentials and SSH keys used on affected machines
- Monitor network traffic for connections to 5tzh3l2e1cetr1chf6osh4tg57b0zqnf.oastify.com
- Use npm audit to check for any other malicious packages in your dependency tree
- Consider implementing npm package signing verification and pre-installation script inspection in your CI/CD pipeline
Sources
- GitHub Advisory GHSA-j6qc-95jf-9rqf · GitHub Advisory Database
Cite this entry
"Malicious code in jobber-app-template-react (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-jobber-app-template-react-npm-yjbokb
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in sme-rko-finance-front-operations-feed-models (npm)
The npm package sme-rko-finance-front-operations-feed-models contained malicious code that downloads and executes attacker-controlled native binaries from remote servers upon package load. The malware uses obfuscation techniques including fragmented string arrays, platform-specific endpoints, and DNS TXT record fallbacks to evade detection.
npmCompromised package - resolvedcritical
Malicious code in modern-localization (npm)
The npm package modern-localization contained malicious code that fetches and executes arbitrary JavaScript from a remote jsonbin.io endpoint on server-side require, with no integrity verification. The payload is executed with full Node.js privileges via Function() or child_process.fork().
npmCompromised package - resolvedcritical
Malicious code in sme-rko-finance-front-operations-tax (npm)
The npm package sme-rko-finance-front-operations-tax contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure on require. The package was identified and reported by OpenSSF's malicious-packages project.
npmCompromised package - resolvedcritical
Malicious code in localization-fixer (npm)
The npm package localization-fixer contained malicious code that fetches and executes arbitrary JavaScript from attacker-controlled jsonbin.io endpoints on package require, granting full Node.js capabilities to remote payloads.
npmCompromised package