Malicious code in osinthell (npm)
The osinthell npm package contains malicious code that performs destructive attacks on Windows systems when its exported sorgu() function is invoked. The package includes 26 sibling modules that execute immediate, irreversible damage including MBR overwriting, filesystem deletion, system process termination, and forced reboot.
- Disclosed
- Last updated
- Blast radius
- Windows hosts running the osinthell npm package
- Ecosystems
- Attack vectors
- Affected entities
- osinthellnpm package containing malicious code
The osinthell npm package was identified as containing malicious code designed to cause severe damage to Windows hosts. The package's primary exported function, sorgu(), invokes 26 sibling modules located under public/a/b/.../z/ directories that collectively execute a coordinated destructive attack.
The malicious modules perform multiple categories of attacks: direct hardware damage (MBR overwriting via \.\PhysicalDrive0), filesystem destruction (recursive deletion of C:\ and C:\Windows\System32 via multiple methods), system process termination (taskkill of critical processes including winlogon, csrss, explorer, and dwm), network disruption (hosts file modification to blackhole major domains), resource exhaustion (fork bombs, memory allocation loops, CPU exhaustion), and forced system reboot.
Additional payload delivery includes downloading and displaying a JPEG image from a Discord CDN URL. The package name and advertised utility purpose serve as a cover for the malicious payload embedded in the exported API.
The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- osinthell
- Domains
- cdn.discordapp.com
Remediation
- Immediately uninstall the osinthell package from all systems
- Audit npm package.json files and lock files for any dependency on osinthell
- Review system logs on Windows hosts that may have executed this package for evidence of the described destructive behaviors
- Restore affected systems from clean backups if MBR or filesystem damage occurred
- Implement npm package scanning and verification in CI/CD pipelines to detect malicious packages before installation
- Monitor npm registry for similar malicious packages using the OpenSSF malicious-packages database
Sources
- GitHub Advisory GHSA-gh9x-wv37-w3xq · GitHub Advisory Database
Cite this entry
"Malicious code in osinthell (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-osinthell-npm-13two7
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in santana-baileys (npm)
Malicious code discovered in santana-baileys npm package that covertly relays WhatsApp messaging data to an attacker-controlled endpoint (https://fiora.nixel.my.id/) via obfuscated character-code reconstruction in the message-send code path.
npmCompromised package - resolvedcritical
Malicious code in elephant-tusk-runner (npm)
The npm package elephant-tusk-runner contained malicious code that exposed a remote shell and remote code execution surface via an unauthenticated Express + WebSocket server binding to 0.0.0.0:4201 with fully open CORS. Any peer able to reach the port could execute arbitrary commands on the host.
npmCompromised package - resolvedcritical
Malicious code in @cats-cdf/browser-metrics-meter (npm)
The npm package @cats-cdf/browser-metrics-meter contained malicious code in its preinstall lifecycle script that exfiltrated system reconnaissance data (username, hostname, public IP) to an OAST collector domain. The package executed this behavior unconditionally on installation without consent or documented purpose.
npmCompromised package - resolvedcritical
Malicious code in @ks-video/kwai-player-web (npm)
The npm package @ks-video/kwai-player-web contained malicious code in its postinstall hook that exfiltrated system reconnaissance data (hostname, username, working directory, network interfaces, environment variable names) over plain HTTP to an unrelated third-party domain. The package has no legitimate relationship to the declared publisher Kwai/@ks-video.
npmCompromised package