Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in multi-acct (npm)

multi-acct@99.99.99 is a malicious npm package that acts as a wrapper to deliver arbitrary code execution. It declares a dependency on vector-cursor-stream-engine that is fetched from an external third-party URL (artifacts.yosiroute.com) with install scripts enabled, allowing remote code execution during npm install.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or system that installed multi-acct@99.99.99 via npm install
Ecosystems
npm
Attack vectors
Compromised packageDependency confusion
Affected entities
  • multi-acct · 99.99.99
  • vector-cursor-stream-enginemalicious dependency fetched from third-party URL

multi-acct@99.99.99 was published to npm as a near-empty wrapper package designed to deliver malicious code. The package's index.js contains only a two-line stub returning name and version literals, with generic placeholder metadata (author listed as 'Package Registry', repository URL pointing to example.com-style placeholder).

The malicious payload is delivered through a single functional dependency, vector-cursor-stream-engine, which is not resolved from the npm registry. Instead, it is hardcoded to fetch from a third-party HTTPS URL: https://artifacts.yosiroute.com/npm/vector-cursor-stream-engine. The package.json shrinkwrap marks this dependency with hasInstallScript:true.

When a developer runs npm install, npm downloads the tarball from artifacts.yosiroute.com and executes its lifecycle scripts, granting arbitrary code execution to whoever controls that host. The URL is unpinned and carries no integrity hash, meaning the delivered bytes can change at any time without detection.

This attack pattern matches a dependency-confusion / lure package where the real payload is delivered through the fetched sub-tarball rather than embedded in the wrapper itself. The incident was identified by the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • multi-acct@99.99.99
Domains
  • artifacts.yosiroute.com

Remediation

  • Immediately uninstall multi-acct@99.99.99 and any projects that depend on it
  • Audit npm install logs and node_modules for the presence of vector-cursor-stream-engine or artifacts from artifacts.yosiroute.com
  • Regenerate any credentials or secrets that may have been exposed on machines where npm install was run with this package
  • Review npm audit and lock files for any unexpected dependencies from external URLs
  • Consider using npm package integrity verification and network policies to prevent fetching packages from non-registry sources

Sources

  1. GitHub Advisory GHSA-38x6-vx4x-xrgv · GitHub Advisory Database

Cite this entry

"Malicious code in multi-acct (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-multi-acct-npm-o52p65

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in sme-rko-finance-front-operations-notifications-impl (npm)

    The npm package sme-rko-finance-front-operations-notifications-impl contained malicious code that executed platform-specific payloads fetched from attacker-controlled infrastructure upon installation. The package used obfuscation and dependency-confusion tactics to evade detection and mimic internal naming conventions.

    npmCompromised packageDependency confusion
  2. containedcritical

    Malicious code in sme-rko-finance-front-payments-currency-payment-domain (npm)

    A malicious npm package named sme-rko-finance-front-payments-currency-payment-domain was published publicly, designed to mimic an internal corporate package name (dependency-confusion attack). On installation or import, the package executes arbitrary native code via multiple obfuscated loader mechanisms, establishing command-and-control communication through DNS TXT records and Cloudflare Workers.

    npmCompromised packageDependency confusion
  3. resolvedcritical

    Malicious code in consumerweb-creditcollection (npm)

    consumerweb-creditcollection@99.9.1 is a malicious npm package that uses dependency confusion to force installation of attacker-controlled code from a Google Cloud Storage bucket. The package exports an empty object but pulls in a dependency (ltidisafe) pinned to an arbitrary tarball URL outside the npm registry, bypassing security scanning.

    npmDependency confusionCompromised package
  4. resolvedcritical

    Malicious code in @united-airlines-org/atmos-design-system (npm)

    The npm package @united-airlines-org/atmos-design-system contains a malicious preinstall script that exfiltrates host reconnaissance data (hostname, directory listing, username) to an attacker-controlled endpoint. The package uses a scope name resembling an internal United Airlines organization, matching a dependency-confusion attack pattern.

    npmCompromised packageDependency confusion