Malicious code in mtslink-depconf-probe-profileusername (npm)
The npm package mtslink-depconf-probe-profileusername contained malicious code designed to probe for internal namespace dependencies and exfiltrate install-time telemetry via DNS lookups to attacker-controlled infrastructure. The package was identified as a dependency-confusion probe targeting internal package namespaces.
- Disclosed
- Last updated
- Blast radius
- Any npm user who installed the malicious package during its availability on npm registry
- Ecosystems
- Attack vectors
- Affected entities
- mtslink-depconf-probe-profileusernamenpm package containing malicious preinstall script
The npm package mtslink-depconf-probe-profileusername was published with malicious intent. The package contained an empty index.js file and a preinstall lifecycle script that performed DNS lookups to probe.4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com, which is Burp Collaborator out-of-band infrastructure controlled by an attacker.
Upon installation via npm, the preinstall script would execute and contact the attacker-controlled subdomain, leaking install-time telemetry including the resolver's IP address, timing information, and a unique subdomain identifier to the third party. This allowed the attacker to detect and track installations of the package.
The package name pattern and description ('Bug bounty auth probe - safe empty package') indicate this was a dependency-confusion or typosquatting probe targeting an internal namespace. The sole functionality of the package was to serve as a beacon for detecting when it was installed, likely as part of reconnaissance for a larger supply chain attack.
The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- mtslink-depconf-probe-profileusername
- Domains
- probe.4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com
Remediation
- Remove the mtslink-depconf-probe-profileusername package from all projects and dependencies
- Audit npm install logs and network traffic for connections to probe.4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com or similar Burp Collaborator domains
- Review package.json and lock files for any unexpected or suspicious package dependencies
- Implement stricter dependency management policies to prevent installation of packages from untrusted sources
- Monitor for similar dependency-confusion probes targeting internal namespaces
- Consider using npm audit and security scanning tools to detect malicious packages before installation
Sources
- GitHub Advisory GHSA-37hp-6fr5-2h6c · GitHub Advisory Database
Cite this entry
"Malicious code in mtslink-depconf-probe-profileusername (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-mtslink-depconf-probe-profileusername-npm-1ahscf
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in lumen-pages-community (npm)
lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in @gfe/lx-watcher (npm)
The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.
npmDependency confusionCompromised package