Malicious code in lumen-pages-community (npm)
lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installs lumen-pages-community@9.9.9 from npm
- Ecosystems
- Attack vectors
- Affected entities
- lumen-pages-community · 9.9.9
lumen-pages-community@9.9.9 was published to npm with a postinstall hook that automatically executes node dc.js during package installation. The script collects sensitive installer metadata including hostname, username, current working directory, platform, Node version, CI environment variables, and npm user-agent information.
This collected data is exfiltrated via an HTTPS GET request to a hardcoded webhook.site URL (https://webhook.site/b00492c6-27ba-4ea0-a9cb-dd50b3770250/dc) with the metadata passed as query parameters. The installer has no control over or visibility into this data collection.
The package exhibits characteristics of a dependency-confusion attack: a high version number (9.9.9), no actual library functionality, and a package name matching a potential internal dependency. The package description labels it a 'research placeholder,' but this does not prevent the malicious runtime behavior.
The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- lumen-pages-community@9.9.9
- Domains
- webhook.site
Remediation
- Immediately uninstall lumen-pages-community@9.9.9 from all environments
- Audit npm install logs and CI/CD logs to identify which systems executed the malicious postinstall hook
- Assume any system that installed this package may have had credentials or sensitive environment variables exposed; rotate credentials and review CI/CD secrets
- Review npm audit and dependency trees to identify any direct or transitive dependencies on lumen-pages-community
- Implement npm package allow-listing or registry proxies to prevent installation of unexpected high-version packages
- Monitor webhook.site URL and any associated accounts for exfiltrated data
Sources
- GitHub Advisory GHSA-cf4g-g969-7qvx · GitHub Advisory Database
Cite this entry
"Malicious code in lumen-pages-community (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 22, 2026; last updated August 22, 2026. https://supplychainattack.org/incident/malicious-code-in-lumen-pages-community-npm-1gulvk
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in @gfe/lx-watcher (npm)
The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in gemini-cli-a2a-server (npm)
A malicious npm package named gemini-cli-a2a-server was published to exploit dependency confusion, mimicking a private Google internal component. The postinstall script collected host identifiers and exfiltrated them to a hardcoded external endpoint.
npmDependency confusionCompromised package