Malicious code in @khaznatech/utils (npm)
The npm package @khaznatech/utils version 99.0.0 contained malicious code in a preinstall script that exfiltrated system hostname and working directory information to an external webhook service. The package was designed as a dependency-confusion probe to identify internal build systems.
- Disclosed
- Last updated
- Blast radius
- Any organization that installed @khaznatech/utils version 99.0.0 during the package's availability on npm; primarily targets internal build systems that may resolve the scoped package name over private registries.
- Ecosystems
- Attack vectors
- Affected entities
- @khaznatech/utils · 99.0.0
The npm package @khaznatech/utils version 99.0.0 contained a preinstall script (install-report.js) that executed automatically during npm install. The script collected the system hostname via os.hostname() and the current working directory basename, then transmitted this information via HTTPS GET request to a hardcoded webhook.site inbox (https://webhook.site/93b065ab-227f-4253-b940-361d00e9b870/).\n\nwebhook.site is an anonymous request-inspection service with no legitimate connection to the package's stated utilities purpose. The scoped package name @khaznatech/utils combined with the unusually high version number 99.0.0 is consistent with a dependency-confusion attack designed to probe whether internal build systems resolve the public package name over a private registry.\n\nThe malicious package was identified and reported by the OpenSSF's malicious-packages project (MAL-2026-13975). Organizations that installed this package during its availability on npm may have had their internal build system configurations exposed.
Indicators of compromise
- Packages
- @khaznatech/utils
- Domains
- webhook.site
Remediation
- Remove @khaznatech/utils version 99.0.0 from all environments and dependency lock files
- Audit npm install logs and build system records for any installations of @khaznatech/utils 99.0.0
- Review network logs for outbound HTTPS connections to webhook.site during the period when the package was available
- If the package was installed in a build environment, assume the hostname and working directory information may have been exfiltrated and review for sensitive data exposure
- Implement package signature verification and private registry policies to prevent dependency-confusion attacks
- Monitor for similar high-version-number scoped packages that may be probing your build infrastructure
Sources
- GitHub Advisory GHSA-x69g-rr7m-w288 · GitHub Advisory Database
Cite this entry
"Malicious code in @khaznatech/utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-khaznatech-utils-npm-1hnqpo
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - containedcritical
Malicious code in @mexc/shared-utils (npm)
Malicious package @mexc/shared-utils published to npm without scope ownership, exploiting dependency-confusion to execute arbitrary code via postinstall hook. The payload collects host metadata and demonstrates install-time code execution against CI/build systems.
npmDependency confusionCompromised package - containedcritical
Malicious code in @polymarkets/clob-client-v2 (npm)
@polymarkets/clob-client-v2 (npm) is a malicious package that typosquats the legitimate @polymarket scope and redirects its inquirer dependency to a lookalike npm registry (registrynpmjs.to) to deliver arbitrary code execution during installation and on first require.
npmTyposquattingCompromised packageDependency confusion