Malicious code in pump-segments-sdk (npm)
The npm package pump-segments-sdk contained malicious code in a postinstall hook that exfiltrated sensitive system and npm configuration data to an attacker-controlled server. The package collected hostname, environment variables, system information, npm auth tokens, and attempted to read password hashes.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed pump-segments-sdk during the malicious distribution period.
- Ecosystems
- Attack vectors
- Affected entities
- pump-segments-sdknpm package containing malicious postinstall hook
The npm package pump-segments-sdk was distributed with malicious code embedded in a postinstall hook that executed automatically upon installation. The script collected extensive sensitive information from the installer's system, including hostname, full process environment variables, platform details, output from system commands (whoami, uname, id, ps aux), current working directory, package.json contents, node_modules directory listing, and attempted reads of /etc/passwd and /etc/shadow files.\n\nThe collected data was exfiltrated via plain HTTP POST requests to a hardcoded Burp Collaborator subdomain (oastify.com). Notably, the exfiltration included the contents of ~/.npmrc, which would expose any npm authentication tokens stored on the installer's system, and attempts to read /etc/shadow to obtain local password hashes.\n\nThe package falsely presented itself as a netbsd-x64 esbuild build, which did not match its actual malicious behavior. This incident was identified and credited to the OpenSSF's malicious-packages repository (MAL-2026-14186).
Indicators of compromise
- Packages
- pump-segments-sdk
- Domains
- oastify.com
Remediation
- Immediately uninstall pump-segments-sdk from all systems and CI/CD pipelines
- Rotate any npm authentication tokens that may have been exposed via ~/.npmrc
- Review system logs and network traffic for evidence of data exfiltration to oastify.com
- Audit process environment variables that were collected for exposure of secrets or credentials
- Verify the integrity of /etc/passwd and /etc/shadow files if the malicious script had sufficient privileges
- Update npm audit and security scanning tools to detect and block this package
- Review package.json and lock files to ensure no remaining references to pump-segments-sdk
Sources
- GitHub Advisory GHSA-4w4g-38g7-35h6 · GitHub Advisory Database
Cite this entry
"Malicious code in pump-segments-sdk (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-pump-segments-sdk-npm-1e16n6
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package