Malicious code in jobber-app-template-react (npm)
The npm package jobber-app-template-react contained malicious code in its preinstall hook that executed automatically on npm install. The script performed host reconnaissance and exfiltrated sensitive system information to a Burp Collaborator domain.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed jobber-app-template-react via npm
- Ecosystems
- Attack vectors
- Affected entities
- jobber-app-template-reactnpm package containing malicious preinstall hook
The npm package jobber-app-template-react was found to contain malicious code in its preinstall hook (index.js) that executed automatically when the package was installed via npm install. The script was unrelated to the package's advertised purpose as a React application template.\n\nThe malicious preinstall script performed host reconnaissance by collecting system information including hostname, username, home directory, DNS servers, and the installation directory (__dirname). It also read sensitive files from the installer's machine, specifically /etc/passwd and /etc/hosts.\n\nThe collected data was then exfiltrated via an HTTPS POST request to a hardcoded Burp Collaborator subdomain (5tzh3l2e1cetr1chf6osh4tg57b0zqnf.oastify.com) as a JSON payload. This behavior is characteristic of a dependency-confusion attack used for reconnaissance and data exfiltration.\n\nThe incident was identified and reported through the OpenSSF malicious packages database (MAL-2026-11137).
Indicators of compromise
- Packages
- jobber-app-template-react
- Domains
- 5tzh3l2e1cetr1chf6osh4tg57b0zqnf.oastify.com
Remediation
- Immediately uninstall jobber-app-template-react from all systems and CI/CD pipelines
- Review npm install logs and audit trails for any installations of jobber-app-template-react
- Assume compromise of any system that installed this package; rotate credentials and SSH keys used on affected machines
- Monitor network traffic for connections to 5tzh3l2e1cetr1chf6osh4tg57b0zqnf.oastify.com
- Use npm audit to check for any other malicious packages in your dependency tree
- Consider implementing npm package signing verification and pre-installation script inspection in your CI/CD pipeline
Sources
- GitHub Advisory GHSA-j6qc-95jf-9rqf · GitHub Advisory Database
Cite this entry
"Malicious code in jobber-app-template-react (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-jobber-app-template-react-npm-yjbokb
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
npmCompromised package