Malicious code in passkeys-react (npm)
The npm package passkeys-react contained malicious code in a preinstall hook that exfiltrated system information (/etc/passwd, /etc/hosts, hostname, username, DNS servers) to an OAST endpoint during installation. The behavior was discovered and reported by OpenSSF's malicious-packages project.
- Disclosed
- Last updated
- Blast radius
- All npm installations of the malicious passkeys-react package versions
- Ecosystems
- Attack vectors
- Affected entities
- passkeys-reactnpm package containing malicious preinstall hook
The npm package passkeys-react was found to contain malicious code embedded in a preinstall hook declared in package.json. When installed via npm, the hook automatically executed index.js, which collected sensitive system information without user consent.
The malicious script gathered hostname, username, home directory, DNS server configuration, current working directory, and the contents of /etc/passwd and /etc/hosts files. This data was then exfiltrated via HTTPS POST requests to a hardcoded subdomain (ltivq9rn7t7gkxho4o1micsk6bc20uoj.oastify.com), identified as a Burp Collaborator out-of-band interaction host used for data exfiltration testing.
The behavior is inconsistent with the package's stated purpose as a passkeys React helper library, which has no legitimate reason to read system configuration files or contact external OAST endpoints. The malicious activity executed automatically during default npm installation, affecting any user who installed the compromised package.
The incident was identified and credited to the OpenSSF's malicious-packages project, which maintains a catalog of confirmed malicious npm, PyPI, and other ecosystem packages.
Indicators of compromise
- Domains
- ltivq9rn7t7gkxho4o1micsk6bc20uoj.oastify.com
Remediation
- Immediately uninstall passkeys-react from all affected systems
- Audit npm install logs to identify when the package was installed
- Assume compromise of systems that installed the malicious package; review for unauthorized access or data exfiltration
- Rotate credentials and SSH keys on affected systems
- Monitor DNS and network traffic for connections to the OAST endpoint
- Use npm audit to check for other malicious packages
- Consider using npm package signing verification and supply chain security tools to prevent similar incidents
Sources
- GitHub Advisory GHSA-8rr9-mc57-cwmx · GitHub Advisory Database
Cite this entry
"Malicious code in passkeys-react (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-passkeys-react-npm-rwxgun
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in ranux-pro (npm)
The npm package ranux-pro contained malicious code disguised as a network socket library. The package shipped a multi-tenant WhatsApp bot with obfuscated code and a mutable dependency override pointing to a personal GitHub account, allowing attackers to execute arbitrary code at install and runtime.
npmCompromised packageMalicious commit