Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in secdriven (npm)

The npm package 'secdriven' version 1.0.8 contains malicious postinstall code that exfiltrates host identity, username, working directory, and CI environment variables to a third-party OOB-detection endpoint. The package is a dependency-confusion payload targeting Google's internal namespace, masquerading as a security research canary.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any npm installer resolving the public 'secdriven' package; targets Google's internal namespace via dependency confusion.
Ecosystems
npm
Attack vectors
Dependency confusionCompromised package
Affected entities
  • secdriven · 1.0.8

The npm package 'secdriven' (version 1.0.8) was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project. The package contains a postinstall.js script that executes on installation and performs unauthorized system reconnaissance.

Upon installation, the malicious script executes the whoami command via child_process and collects sensitive environment data including the system hostname, platform, current working directory, and CI/GitHub repository environment variables. This information is then transmitted without user consent to a hardcoded interactsh subdomain (lg5ys3jebfzwk366pilidbmah1nsbszh.oastify.com) via HTTPS GET requests under the path /google/secdriven/. A secondary exfiltration channel uses DNS lookups with the whoami output as a subdomain.

The package metadata—including its description ("Security research canary — Google") and README pointing to a Google CTF internal package.json—indicates this is a dependency-confusion attack targeting Google's internal package namespace. Any installer whose resolver picks up this public package name leaks host identity, username, working directory, and CI repository information to the attacker's OOB-detection endpoint.

Whether published as research or as an active attack, the installer-side effect is identical: unconsented identity and environment exfiltration at install time.

Indicators of compromise

Packages
  • secdriven
Domains
  • lg5ys3jebfzwk366pilidbmah1nsbszh.oastify.com

Remediation

  • Immediately uninstall the 'secdriven' package from all environments
  • Audit npm install logs and CI/CD logs for any installations of secdriven version 1.0.8 or earlier
  • Assume any system that installed this package has had its hostname, username, working directory, and CI repository information exposed
  • Review and rotate credentials for any CI/CD systems that may have been affected
  • Implement npm package allow-listing or use private registries to prevent dependency-confusion attacks
  • Monitor for suspicious outbound HTTPS connections to interactsh subdomains
  • Consider using npm audit and supply-chain security tools to detect similar malicious packages

Sources

  1. GitHub Advisory GHSA-vf52-4986-52f7 · GitHub Advisory Database

Cite this entry

"Malicious code in secdriven (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-secdriven-npm-14bkri

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in @pelmnaads/naads-common-logger (npm)

    Malicious code in @pelmnaads/naads-common-logger (npm) version 19999.0.1 exploited dependency confusion by publishing to the public npm registry with an abnormally high version number. A preinstall script transmitted installer hostname data to a Burp Collaborator endpoint (h5nvwrz2815ubw84cpkwhezm5db9z1nq.b.mburpcollab.com), silently exfiltrating build host identity.

    npmDependency confusionCompromised package
  2. resolvedcritical

    Malicious code in @convera/ui-shared (npm)

    The npm package @convera/ui-shared version 0.0.2 contained malicious code that exfiltrated system hostname and username during installation via a preinstall script. The package was published under a private namespace scope, creating a dependency-confusion attack surface against the Convera organization.

    npmCompromised packageDependency confusion
  3. resolvedcritical

    Malicious code in @webapp-next/store (npm)

    The npm package @webapp-next/store contained malicious code that executed automatically on installation, collecting system and user information and exfiltrating it to an attacker-controlled server. The package had no legitimate functionality and used a dependency-confusion lure with a scope resembling a legitimate namespace.

    npmCompromised packageDependency confusion
  4. containedcritical

    Malicious code in @design-system-coopeuch/web (npm)

    @design-system-coopeuch/web versions 999.0.4 and 999.0.0 on npm contained malicious code implementing a dependency-confusion attack. The package included a preinstall hook that exfiltrated host identifiers (hostname, working directory, user ID, environment variables) to a hardcoded IP address via cleartext HTTP.

    npmDependency confusionCompromised package