Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in no-for-of-loops (npm)

The npm package no-for-of-loops was found to contain malicious code that redirects dependency resolution to an attacker-controlled server (pack.nppacks.com) over unencrypted HTTP, allowing arbitrary code execution during npm install.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or system installing the malicious no-for-of-loops package via npm.
Ecosystems
npm
Attack vectors
Compromised packageDependency confusion
Affected entities
  • no-for-of-loopsnpm package with malicious code

The npm package no-for-of-loops was identified as containing malicious code by Amazon Inspector and credited to the OpenSSF malicious-packages project. The package's package.json declares no-for-of-loops as both a dependency and devDependency, but points to http://pack.nppacks.com/npm/no-for-of-loops instead of the official npm registry.

When a consumer runs npm install, npm fetches a tarball from the attacker-controlled host over unencrypted HTTP without integrity verification. This allows the domain operator to serve arbitrary, mutable code on each fetch, which executes within the installer's dependency tree. The package auto-executes on default npm install without requiring user opt-in.

The package's metadata—including a self-identification as a 'Security Research Testing Purpose' artifact and a generic 'NPM' description—is consistent with a proof-of-concept hijack vector rather than a legitimate utility. This incident demonstrates the risk of dependency confusion and the importance of verifying package sources and using authenticated, integrity-checked downloads.

Indicators of compromise

Packages
  • no-for-of-loops
Domains
  • pack.nppacks.com

Remediation

  • Remove the no-for-of-loops package from all projects and dependency trees
  • Audit npm install logs and node_modules for any unexpected packages or modifications from the attacker-controlled domain
  • Use npm audit to identify any other compromised dependencies
  • Enable npm package integrity verification and consider using npm lockfiles with hash validation
  • Configure npm to reject packages from non-registry sources or require explicit approval
  • Monitor for any suspicious activity or data exfiltration from systems that may have installed this package

Sources

  1. GitHub Advisory GHSA-22p7-qq4h-5rw4 · GitHub Advisory Database

Cite this entry

"Malicious code in no-for-of-loops (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-no-for-of-loops-npm-pxw4wk

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  2. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  3. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion
  4. resolvedcritical

    Malicious code in @gfe/lx-watcher (npm)

    The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.

    npmDependency confusionCompromised package