Malicious code in @khaznatech/common (npm)
The npm package @khaznatech/common contained malicious code in its preinstall script (install-report.js) that exfiltrated installer hostname and working directory information to an anonymous webhook.site endpoint without user consent or disclosure. The behavior was disguised as telemetry but directed at third-party infrastructure rather than package-owned systems.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed @khaznatech/common during the malicious period.
- Ecosystems
- Attack vectors
- Affected entities
- @khaznatech/commonnpm package with malicious preinstall script
The npm package @khaznatech/common was found to contain malicious code in its preinstall script (install-report.js). The script executes automatically during npm install and performs an HTTPS GET request to a hardcoded webhook.site capture endpoint.\n\nThe script appends the installer's hostname (via os.hostname()) and current working directory basename (via process.cwd()) to the URL path, exfiltrating information that identifies both the installer's machine and the project being worked on. webhook.site is an anonymous third-party request-capture service, not infrastructure owned or controlled by the package publisher.\n\nThe malicious behavior was labeled as "install telemetry" in code comments but was neither disclosed to users, opt-in, nor directed at a legitimate package-owned or caller-configured destination. This represents a clear supply chain compromise through a malicious preinstall script.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository (MAL-2026-13973).
Indicators of compromise
- Packages
- @khaznatech/common
Remediation
- Remove @khaznatech/common from all projects and dependencies
- Audit npm install logs and network traffic from the period when @khaznatech/common was installed to identify potential data exfiltration
- Review systems where @khaznatech/common was installed for any unauthorized access or lateral movement
- Update npm to the latest version and run `npm audit` to identify other potentially compromised packages
- Consider implementing npm package signing verification and preinstall script inspection in your supply chain security practices
Sources
- GitHub Advisory GHSA-f23c-rm7x-p3c2 · GitHub Advisory Database
Cite this entry
"Malicious code in @khaznatech/common (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-khaznatech-common-npm-1cnrh0
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - containedcritical
Malicious code in checkout-desktop-total (npm)
The npm package checkout-desktop-total contained malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under wel1.ru. Any system that imported this package should be considered compromised.
npmCompromised package - containedcritical
Malicious code in epic-common (npm)
The npm package epic-common was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package