Malicious code in osinthell (npm)
The osinthell npm package contains malicious code that performs destructive attacks on Windows systems when its exported sorgu() function is invoked. The package includes 26 sibling modules that execute immediate, irreversible damage including MBR overwriting, filesystem deletion, system process termination, and forced reboot.
- Disclosed
- Last updated
- Blast radius
- Windows hosts running the osinthell npm package
- Ecosystems
- Attack vectors
- Affected entities
- osinthellnpm package containing malicious code
The osinthell npm package was identified as containing malicious code designed to cause severe damage to Windows hosts. The package's primary exported function, sorgu(), invokes 26 sibling modules located under public/a/b/.../z/ directories that collectively execute a coordinated destructive attack.
The malicious modules perform multiple categories of attacks: direct hardware damage (MBR overwriting via \.\PhysicalDrive0), filesystem destruction (recursive deletion of C:\ and C:\Windows\System32 via multiple methods), system process termination (taskkill of critical processes including winlogon, csrss, explorer, and dwm), network disruption (hosts file modification to blackhole major domains), resource exhaustion (fork bombs, memory allocation loops, CPU exhaustion), and forced system reboot.
Additional payload delivery includes downloading and displaying a JPEG image from a Discord CDN URL. The package name and advertised utility purpose serve as a cover for the malicious payload embedded in the exported API.
The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- osinthell
- Domains
- cdn.discordapp.com
Remediation
- Immediately uninstall the osinthell package from all systems
- Audit npm package.json files and lock files for any dependency on osinthell
- Review system logs on Windows hosts that may have executed this package for evidence of the described destructive behaviors
- Restore affected systems from clean backups if MBR or filesystem damage occurred
- Implement npm package scanning and verification in CI/CD pipelines to detect malicious packages before installation
- Monitor npm registry for similar malicious packages using the OpenSSF malicious-packages database
Sources
- GitHub Advisory GHSA-gh9x-wv37-w3xq · GitHub Advisory Database
Cite this entry
"Malicious code in osinthell (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-osinthell-npm-13two7
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in epic-common (npm)
The npm package epic-common was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - containedcritical
Malicious code in checkout-desktop-total (npm)
The npm package checkout-desktop-total contained malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under wel1.ru. Any system that imported this package should be considered compromised.
npmCompromised package - containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package