Malicious code in node-ci-utils (npm)
The npm package node-ci-utils contained malicious code that, on require(), downloads and executes an unsigned binary from attacker-controlled infrastructure. The package used obfuscation techniques (base64-encoded URL, single-letter variables) to evade detection.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI runner that installed and imported the malicious package version would execute attacker-supplied code.
- Ecosystems
- Attack vectors
- Affected entities
- node-ci-utilsnpm package containing malicious code in index.js
The npm package node-ci-utils was found to contain malicious code in its index.js file. When the package is imported via require('node-ci-utils'), a top-level _init() function executes on Linux systems, creating a hidden directory at ~/.local/share/.node_cache/ and downloading an opaque binary from https://api.ingress-hub.com/cdn/assets/update.pkg using a spoofed Chrome User-Agent.\n\nThe downloaded binary is written to .runtime, given executable permissions (0755), and spawned as a detached child process with stdio redirected to /dev/null and unref() called to allow it to survive the parent process termination. No cryptographic verification (hash or signature) is performed on the downloaded binary.\n\nThe attacker employed multiple evasion techniques: the malicious URL was stored as a base64-encoded literal to avoid detection during source code review, and variable names were intentionally obfuscated using single letters (_D, _N, _P, _F, _U, _A). The destination domain does not match the package's stated purpose of "build environment validation" and is not a recognized publisher CDN.\n\nAny developer or CI/CD system that installed and imported this package would execute arbitrary attacker-supplied code in the background. The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- node-ci-utils
- Domains
- api.ingress-hub.com
Remediation
- Immediately uninstall node-ci-utils from all development environments and CI/CD systems
- Audit npm package.json and lock files for any dependency on node-ci-utils
- Review system logs and process execution history on any machine that imported this package for signs of unauthorized binary execution
- Rotate credentials and API keys that may have been exposed on affected systems
- Update npm to the latest version and run `npm audit` to identify other potentially compromised dependencies
- Consider implementing package signature verification and allowlisting for critical dependencies
Sources
- GitHub Advisory GHSA-p6pp-223j-cq7j · GitHub Advisory Database
Cite this entry
"Malicious code in node-ci-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-node-ci-utils-npm-1dt581
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in edu-npm-dependency-chain-demo
Malware discovered in the npm package edu-npm-dependency-chain-demo. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in roblox-api-client
Malware was discovered in the npm package roblox-api-client, resulting in full system compromise for any computer with the package installed or running. The advisory recommends immediate removal of the package and rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malware in jextic-eclib
Malware was discovered in the npm package jextic-eclib, resulting in full system compromise of any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in @thone33/analytics-injector
Malware discovered in the npm package @thone33/analytics-injector. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package