Malicious code in @pelmnaads/naads-common-logger (npm)
Malicious code in @pelmnaads/naads-common-logger (npm) version 19999.0.1 exploited dependency confusion by publishing to the public npm registry with an abnormally high version number. A preinstall script transmitted installer hostname data to a Burp Collaborator endpoint (h5nvwrz2815ubw84cpkwhezm5db9z1nq.b.mburpcollab.com), silently exfiltrating build host identity.
- Disclosed
- Last updated
- Blast radius
- Any build system or developer environment that resolved @pelmnaads/naads-common-logger version 19999.0.1 from the public npm registry, particularly internal Pelmorex build pipelines expecting a private package of the same name.
- Ecosystems
- Attack vectors
- Affected entities
- @pelmnaads/naads-common-logger · 19999.0.1
The package @pelmnaads/naads-common-logger was published to the public npm registry under version 19999.0.1, following the canonical dependency-confusion attack pattern. The abnormally high version number was designed to make npm's resolver prefer this public package over an internal private package of the same name within Pelmorex's infrastructure.
Upon installation, a preinstall lifecycle script (preinstall.js:5-9) executed an HTTPS GET request to h5nvwrz2815ubw84cpkwhezm5db9z1nq.b.mburpcollab.com with query parameters transmitting the installer's hostname. This resulted in silent exfiltration of build host identity to a third-party Burp Collaborator out-of-band interaction endpoint.
The package README claimed this was an authorized security test; however, the code path and effect on unsuspecting installers were identical to a hostile dependency-confusion attack. Any build system resolving this package—particularly internal Pelmorex pipelines expecting the private @pelmnaads/naads-common-logger—would leak hostname data without opt-in or notification.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @pelmnaads/naads-common-logger
- Domains
- h5nvwrz2815ubw84cpkwhezm5db9z1nq.b.mburpcollab.com
Remediation
- Immediately remove @pelmnaads/naads-common-logger version 19999.0.1 from all build environments and dependency locks
- Audit npm install logs and build system records to identify any hosts that resolved this package and may have transmitted hostname data
- Review internal npm registry configuration to ensure private packages are properly scoped and authenticated to prevent dependency confusion
- Implement npm package signature verification and allowlist policies for critical build dependencies
- Monitor for any suspicious outbound connections to h5nvwrz2815ubw84cpkwhezm5db9z1nq.b.mburpcollab.com or related Burp Collaborator domains
- Establish pre-installation scanning and validation of packages before resolution in build pipelines
Sources
- GitHub Advisory GHSA-2fqh-pwxg-9x86 · GitHub Advisory Database
Cite this entry
"Malicious code in @pelmnaads/naads-common-logger (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-pelmnaads-naads-common-logger-npm-h7qkyh
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @convera/ui-shared (npm)
The npm package @convera/ui-shared version 0.0.2 contained malicious code that exfiltrated system hostname and username during installation via a preinstall script. The package was published under a private namespace scope, creating a dependency-confusion attack surface against the Convera organization.
npmCompromised packageDependency confusion - containedcritical
Malicious code in secdriven (npm)
The npm package 'secdriven' version 1.0.8 contains malicious postinstall code that exfiltrates host identity, username, working directory, and CI environment variables to a third-party OOB-detection endpoint. The package is a dependency-confusion payload targeting Google's internal namespace, masquerading as a security research canary.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in @webapp-next/store (npm)
The npm package @webapp-next/store contained malicious code that executed automatically on installation, collecting system and user information and exfiltrating it to an attacker-controlled server. The package had no legitimate functionality and used a dependency-confusion lure with a scope resembling a legitimate namespace.
npmCompromised packageDependency confusion - containedcritical
Malicious code in @design-system-coopeuch/web (npm)
@design-system-coopeuch/web versions 999.0.4 and 999.0.0 on npm contained malicious code implementing a dependency-confusion attack. The package included a preinstall hook that exfiltrated host identifiers (hostname, working directory, user ID, environment variables) to a hardcoded IP address via cleartext HTTP.
npmDependency confusionCompromised package