Malicious code in optimizely-starter-kit-for-fastly-compute (npm)
The npm package optimizely-starter-kit-for-fastly-compute contained malicious code that executed automatically on installation, collecting system information and exfiltrating it to an attacker-controlled domain. The package name resembles legitimate Optimizely/Fastly tooling, suggesting a typosquatting or dependency-confusion attack.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed the malicious package via npm install
- Ecosystems
- Attack vectors
- Affected entities
- optimizely-starter-kit-for-fastly-computeMalicious npm package with preinstall script
The npm package optimizely-starter-kit-for-fastly-compute contained a malicious preinstall script that executed automatically when the package was installed via npm install. The package.json declared preinstall: node index.js, triggering the execution of index.js during installation.
The malicious script collected sensitive host identifiers including the system hostname, user information, home directory, DNS servers, the package installation directory, and package.json contents. It also read system files /etc/passwd and /etc/hosts, then exfiltrated this data via HTTPS POST requests to aguu8c8gjyt4anjao3nhru1mgdm5avyk.oastify.com, a Burp Collaborator out-of-band interaction subdomain used for data exfiltration.
The package name closely resembles legitimate Optimizely and Fastly Compute tooling, consistent with a typosquatting or dependency-confusion attack designed to trick developers into installing the malicious package. The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- optimizely-starter-kit-for-fastly-compute
- Domains
- aguu8c8gjyt4anjao3nhru1mgdm5avyk.oastify.com
Remediation
- Immediately uninstall optimizely-starter-kit-for-fastly-compute from all systems and projects
- Review npm install logs and audit systems that may have installed this package for signs of compromise
- Rotate credentials and SSH keys on any systems where the package was installed
- Monitor network traffic for connections to aguu8c8gjyt4anjao3nhru1mgdm5avyk.oastify.com
- Use npm audit to check for this package in dependency trees
- Implement package verification and allowlisting policies to prevent installation of typosquatted or suspicious packages
- Consider using private npm registries or package proxies with security scanning
Sources
- GitHub Advisory GHSA-g69x-5m73-rm58 · GitHub Advisory Database
Cite this entry
"Malicious code in optimizely-starter-kit-for-fastly-compute (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-optimizely-starter-kit-for-fastly-compute-npm-1rv35n
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package