Malicious code in pilgrimage-portal-client (npm)
pilgrimage-portal-client version 99.0.0 on npm contained malicious code in a postinstall hook that exfiltrated the installer's hostname, timestamp, and package metadata to an attacker-controlled IP endpoint (http://134.119.222.10:9009/canary) over plain HTTP without user consent.
- Disclosed
- Last updated
- Blast radius
- Any developer or system installing pilgrimage-portal-client version 99.0.0 from npm.
- Ecosystems
- Attack vectors
- Affected entities
- pilgrimage-portal-client · 99.0.0
The npm package pilgrimage-portal-client version 99.0.0 contained malicious code executed during installation. The postinstall hook ran node ping.js, which automatically collected and transmitted sensitive host information to an attacker-controlled endpoint.
The malicious behavior involved reading the installer's hostname via require('os').hostname() and POSTPing it along with a timestamp and package name/version to the hardcoded bare-IP endpoint http://134.119.222.10:9009/canary over unencrypted HTTP. Any errors or timeouts were silently suppressed, making the exfiltration difficult to detect.
The version number (99.0.0) and beacon pattern are consistent with a dependency-confusion attack, where a malicious package is published to a public registry to intercept installations. The destination is a non-first-party bare IP address that the installer never configured, and the outbound call fires automatically without user consent, confirming intentional malicious behavior.
This incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- pilgrimage-portal-client
- IPs
- 134.119.222.10
Remediation
- Immediately uninstall pilgrimage-portal-client version 99.0.0 from all systems
- Audit npm install logs and network traffic for connections to http://134.119.222.10:9009 during the installation window
- Review and rotate any credentials or sensitive data that may have been exposed on affected systems
- Use npm audit to identify any remaining vulnerable dependencies
- Consider implementing npm package signing verification and private registry mirrors to prevent dependency-confusion attacks
- Monitor for any suspicious activity originating from systems that installed the malicious package
Sources
- GitHub Advisory GHSA-r69p-2jjg-vh25 · GitHub Advisory Database
Cite this entry
"Malicious code in pilgrimage-portal-client (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-pilgrimage-portal-client-npm-1qmmyo
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in ssb-test-package (npm)
ssb-test-package@1.0.0 on npm contains malicious code designed as a dependency-confusion proof-of-concept. A preinstall hook executes arbitrary code on installation, performing host reconnaissance and writing results to a local file.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in mtslink-depconf-probe-profileusername (npm)
The npm package mtslink-depconf-probe-profileusername contained malicious code designed to probe for internal namespace dependencies and exfiltrate install-time telemetry via DNS lookups to attacker-controlled infrastructure. The package was identified as a dependency-confusion probe targeting internal package namespaces.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package - containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package