Malicious code in notafollower1 (npm)
The npm package notafollower1 contained malicious code in its postinstall script that exfiltrated AWS ECS container metadata and environment details to an attacker-controlled ngrok tunnel. The script included fingerprinting logic to detect security research and sandbox environments.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system installing the notafollower1 npm package would execute the malicious postinstall script, exposing AWS ECS container metadata and environment details to an attacker-controlled endpoint.
- Ecosystems
- Attack vectors
- Affected entities
- notafollower1npm package with malicious postinstall script
The notafollower1 npm package contained a postinstall script that automatically executed upon installation. The script collected sensitive AWS ECS container task metadata via the ECS_CONTAINER_METADATA_URI_V4 endpoint, including task ARN, container names, and image names.\n\nThe collected data was exfiltrated via HTTP POST to a hardcoded ngrok tunnel at https://mourner-slot-explicit.ngrok-free.dev using curl. The script included deliberate fingerprinting logic to detect known security research operators (twbray, packagehound, wiz, oss-dynamic) by inspecting container image names, indicating the attacker was attempting to evade detection and analysis.\n\nThe destination ngrok tunnel is unrelated to any legitimate publisher infrastructure, confirming malicious intent. Installation of this package in CI/CD or containerized environments would expose sensitive infrastructure metadata to a third party.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- notafollower1
- Domains
- mourner-slot-explicit.ngrok-free.dev
Remediation
- Immediately uninstall notafollower1 from all systems and CI/CD pipelines
- Audit AWS ECS task metadata and container environment logs for unauthorized access or exfiltration during the period the package was installed
- Review npm package dependencies to identify any direct or transitive dependencies on notafollower1
- Implement npm package scanning and verification in CI/CD pipelines to detect malicious postinstall scripts
- Rotate any AWS credentials or sensitive data that may have been exposed through container metadata
- Monitor the ngrok tunnel endpoint (https://mourner-slot-explicit.ngrok-free.dev) for any data exfiltration attempts
Sources
- GitHub Advisory GHSA-2p7x-477v-rh68 · GitHub Advisory Database
Cite this entry
"Malicious code in notafollower1 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-notafollower1-npm-50xsrg
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malware in alphazone
The npm package alphazone contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in core-tailwindcss-utility (npm)
core-tailwindcss-utility, an npm package falsely advertised as a Tailwind CSS utility, contains malicious code that fetches and executes arbitrary Node.js code from a remote C2 server. The package includes suspicious dependencies for credential theft and remote communication.
npmCompromised package - containedcritical
Malware in chai-as-deployer
Malware was discovered in the npm package chai-as-deployer, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package