Malicious code in price-scripping-js (npm)
price-scripping-js@1.1.2 on npm contained malicious code that exfiltrated .env files during installation. The package's postinstall script read the project's environment configuration and POSTed the full parsed key/value JSON to a remote HTTP endpoint, exposing sensitive credentials and secrets.
- Disclosed
- Last updated
- Blast radius
- Any npm project that installed price-scripping-js@1.1.2 during the postinstall phase, with potential exposure of .env files containing database credentials, cloud provider keys, API tokens, and other production secrets.
- Ecosystems
- Attack vectors
- Affected entities
- price-scripping-js · 1.1.2
price-scripping-js@1.1.2 contained a malicious postinstall script that executed node dist/postinstall.js during npm installation. The script resolved the installing project's root directory, read the .env file, parsed it using dotenv, and exfiltrated the full parsed key/value JSON to a remote HTTP endpoint.
The destination URL was obfuscated using base58 encoding split across two source files (index.js and cli.js), with fragments concatenated and decoded at runtime. This obfuscation was explicitly designed to hide the HTTP endpoint. Error handling was silently swallowed to prevent npm install from surfacing the exfiltration activity.
The package falsely advertised itself as a crypto-price fetcher in package.json, but its README was copied from the unrelated undici-types project. The actual functionality consisted solely of reading .env files and uploading them to the attacker's server. Since .env files typically contain database credentials, cloud provider keys, API tokens, and other production secrets, the compromise posed a critical risk to any project that installed this version.
The malicious package was identified by Amazon Inspector and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- price-scripping-js@1.1.2
Remediation
- Immediately remove price-scripping-js@1.1.2 from all projects and dependencies
- Audit npm install logs to identify when the malicious version was installed
- Rotate all credentials, API keys, database passwords, and cloud provider keys that may have been exposed via .env files
- Review access logs for the remote HTTP endpoint if the URL can be reconstructed
- Implement npm package scanning and verification in CI/CD pipelines to detect malicious postinstall scripts
- Use npm audit and security tools to monitor for similar malicious packages
- Consider using npm lockfiles and package integrity verification to prevent installation of compromised versions
Sources
- GitHub Advisory GHSA-j9wm-g3ph-vf3q · GitHub Advisory Database
Cite this entry
"Malicious code in price-scripping-js (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-price-scripping-js-npm-pojrna
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package