Malicious code in nms-dashboard-js (npm)
nms-dashboard-js@9.9.11 on npm contained malicious code that exfiltrated host identifiers (username, hostname, working directory) via DNS out-of-band to oob.sl4x0.xyz. The payload was obfuscated using hex char-code arrays and executed both on package installation and on any require() call.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed nms-dashboard-js@9.9.11
- Ecosystems
- Attack vectors
- Affected entities
- nms-dashboard-js · 9.9.11
nms-dashboard-js@9.9.11 was published to npm with malicious code embedded in the package. The attack was triggered via an npm install lifecycle hook that unconditionally loaded obfuscated code from lib/core.
The malicious payload reconstructed API calls at runtime from hex char-code arrays to evade detection. It collected system identifiers—the current user's username, system hostname, and the basename of the current working directory—concatenated them with a timestamp, and issued a DNS resolution query to a subdomain of oob.sl4x0.xyz to exfiltrate the data via out-of-band DNS.
The beacon executed not only during package installation but also on any require() of the package, maximizing exposure. The obfuscation was implemented across multiple files (lib/b02e30.js and lib/6ad264.js) to conceal the network sink and API names.
The package was advertised as providing "enterprise utilities," which would not legitimately require any network activity, making the malicious behavior clearly anomalous.
Indicators of compromise
- Packages
- nms-dashboard-js
- Domains
- oob.sl4x0.xyz
Remediation
- Immediately uninstall nms-dashboard-js@9.9.11 from all systems
- Audit npm install logs to identify when the package was installed and on which hosts
- Assume host identifiers (username, hostname) may have been exfiltrated; consider credential rotation if sensitive operations were performed from affected systems
- Review npm package dependencies to ensure no other packages depend on nms-dashboard-js
- Monitor for suspicious DNS queries to oob.sl4x0.xyz or similar domains from affected hosts
- Use npm audit to check for other malicious packages and keep npm and Node.js updated
Sources
- GitHub Advisory GHSA-c3ch-m7ff-x6vx · GitHub Advisory Database
Cite this entry
"Malicious code in nms-dashboard-js (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-nms-dashboard-js-npm-7fnhjm
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit