Malicious code in lib-frontsga (npm)
Malicious npm package 'lib-frontsga' version 9.999.999 exploits dependency confusion to target organizations with an internal package of the same name. A preinstall/postinstall script collects host and CI environment identifiers and exfiltrates them via DNS and HTTP callbacks to an attacker-controlled domain.
- Disclosed
- Last updated
- Blast radius
- Organizations using an internal package named 'lib-frontsga' without a scoped or internal registry pin will resolve and execute the malicious public package.
- Ecosystems
- Attack vectors
- Affected entities
- lib-frontsga · 9.999.999
The npm package 'lib-frontsga' at version 9.999.999 was published to the public npm registry as a dependency-confusion attack. The package contains a preinstall/postinstall lifecycle script (poc.js) that executes during npm install.\n\nThe script collects sensitive host and build environment identifiers including hostname, username, current working directory, Node version, and CI/build system variables (GITHUB_REPOSITORY, GITHUB_REPOSITORY_OWNER, GITHUB_ACTOR, GITHUB_RUN_ID, GITHUB_WORKFLOW, npm_config_registry, RUNNER_NAME, AWS_REGION, and Azure/Jenkins/GitLab identifiers).\n\nCollected data is exfiltrated to a hardcoded attacker-controlled callback domain (votspfykpbaortacnitltze3m5k5swzg6.oast.fun) via DNS queries and HTTP/HTTPS POST requests. Organizations that internally use a package named 'lib-frontsga' without a scoped or internal registry pin will resolve the public malicious copy during dependency resolution and execute the beacon.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- lib-frontsga@9.999.999
- Domains
- votspfykpbaortacnitltze3m5k5swzg6.oast.fun
Remediation
- Remove or uninstall lib-frontsga version 9.999.999 from all environments
- Audit npm install logs and CI/build system logs for execution of this package between publication and discovery
- Review exfiltrated environment variables for exposure of sensitive CI credentials or repository information
- Implement internal scoped package registry or use npm registry pinning to prevent dependency confusion attacks
- Monitor for any suspicious outbound DNS or HTTP connections to votspfykpbaortacnitltze3m5k5swzg6.oast.fun
- Rotate any exposed CI tokens, AWS credentials, or other secrets that may have been collected
Sources
- GitHub Advisory GHSA-gjrm-rjj5-9x2v · GitHub Advisory Database
Cite this entry
"Malicious code in lib-frontsga (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-lib-frontsga-npm-n4mgcl
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - containedcritical
Malicious code in alelo-utils (npm)
Malicious code in alelo-utils npm package version 99.0.0 exfiltrates system information and credentials during installation. The package uses preinstall and postinstall scripts to collect hostname, username, environment variables, .npmrc tokens, .env files, and cloud credentials, sending them to an attacker-controlled IP address.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in alelo-sdk (npm)
alelo-sdk@99.0.0 on npm contains malicious lifecycle scripts that harvest sensitive environment data (credentials, tokens, secrets) and exfiltrate it to a hardcoded IP endpoint. The package uses dependency confusion tactics targeting a private 'alelo' scope with an inflated version number.
npmCompromised packageDependency confusion