Malicious code in shopping-shared-atom-mobile-cart-counter (npm)
shopping-shared-atom-mobile-cart-counter@20.6.6 (npm) contains malicious code that downloads and executes platform-specific binaries at runtime via obfuscated C2 communication, disguised as telemetry/analytics functionality.
- Disclosed
- Last updated
- Blast radius
- Any application using shopping-shared-atom-mobile-cart-counter@20.6.6 in npm environments (Node.js, Electron, bundled web applications).
- Ecosystems
- Attack vectors
- Affected entities
- shopping-shared-atom-mobile-cart-counter · 20.6.6
The npm package shopping-shared-atom-mobile-cart-counter version 20.6.6 contains malicious code injected into its loader.js module. The loader is executed at require() time and constructs command-and-control (C2) hostnames dynamically using array-join operations to evade static analysis detection.\n\nThe malicious code downloads platform-specific binaries from C2 servers (including oob-worker.cf101-adf.workers.dev and cf103-070/cf102-baf/cf99-9b3.workers.dev) and writes them to temporary directories (/var/tmp on Unix, %TEMP% on Windows) under disguised filenames such as dotnet_diag.exe or .cache_. The binaries are then executed detached via shell commands (/bin/sh -c on Unix, cmd /c start on Windows).\n\nThe attack uses a cover story of telemetry and analytics collection, with marker files and environment variables (DISABLE_TELEMETRY, DO_NOT_TRACK) providing plausible deniability. The fetched binaries are opaque and unrelated to the package's stated purpose as a mobile cart-counter component. A DNS-TXT chunked fallback mechanism under win.dl.well1.site provides redundant C2 communication.\n\nThis incident was identified by the OpenSSF malicious-packages project and published via GitHub Security Advisory GHSA-9mcv-4v2c-mv32.
Indicators of compromise
- Packages
- shopping-shared-atom-mobile-cart-counter
- Domains
- oob-worker.cf101-adf.workers.dev
- cf103-070/cf102-baf/cf99-9b3.workers.dev
- win.dl.well1.site
Remediation
- Immediately remove shopping-shared-atom-mobile-cart-counter@20.6.6 from all dependencies and lock files.
- Audit all applications that installed this package version for signs of unauthorized binary execution or network connections to the identified C2 domains.
- Review process execution logs and temporary file creation for suspicious activity matching the described binary names and execution patterns.
- Update to a patched version of the package if available, or replace with an alternative trusted package.
- Monitor for network connections to oob-worker.cf101-adf.workers.dev, cf103-070/cf102-baf/cf99-9b3.workers.dev, and win.dl.well1.site.
- Regenerate any credentials or secrets that may have been exposed on affected systems.
Sources
- GitHub Advisory GHSA-9mcv-4v2c-mv32 · GitHub Advisory Database
Cite this entry
"Malicious code in shopping-shared-atom-mobile-cart-counter (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-shopping-shared-atom-mobile-cart-counter-npm-12q2zn
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit