Malicious code in shopping-shared-atom-mobile-cart-counter (npm)
shopping-shared-atom-mobile-cart-counter@20.6.6 (npm) contains malicious code that downloads and executes platform-specific binaries at runtime via obfuscated C2 communication, disguised as telemetry/analytics functionality.
- Disclosed
- Last updated
- Blast radius
- Any application using shopping-shared-atom-mobile-cart-counter@20.6.6 in npm environments (Node.js, Electron, bundled web applications).
- Ecosystems
- Attack vectors
- Affected entities
- shopping-shared-atom-mobile-cart-counter · 20.6.6
The npm package shopping-shared-atom-mobile-cart-counter version 20.6.6 contains malicious code injected into its loader.js module. The loader is executed at require() time and constructs command-and-control (C2) hostnames dynamically using array-join operations to evade static analysis detection.\n\nThe malicious code downloads platform-specific binaries from C2 servers (including oob-worker.cf101-adf.workers.dev and cf103-070/cf102-baf/cf99-9b3.workers.dev) and writes them to temporary directories (/var/tmp on Unix, %TEMP% on Windows) under disguised filenames such as dotnet_diag.exe or .cache_. The binaries are then executed detached via shell commands (/bin/sh -c on Unix, cmd /c start on Windows).\n\nThe attack uses a cover story of telemetry and analytics collection, with marker files and environment variables (DISABLE_TELEMETRY, DO_NOT_TRACK) providing plausible deniability. The fetched binaries are opaque and unrelated to the package's stated purpose as a mobile cart-counter component. A DNS-TXT chunked fallback mechanism under win.dl.well1.site provides redundant C2 communication.\n\nThis incident was identified by the OpenSSF malicious-packages project and published via GitHub Security Advisory GHSA-9mcv-4v2c-mv32.
Indicators of compromise
- Packages
- shopping-shared-atom-mobile-cart-counter
- Domains
- oob-worker.cf101-adf.workers.dev
- cf103-070/cf102-baf/cf99-9b3.workers.dev
- win.dl.well1.site
Remediation
- Immediately remove shopping-shared-atom-mobile-cart-counter@20.6.6 from all dependencies and lock files.
- Audit all applications that installed this package version for signs of unauthorized binary execution or network connections to the identified C2 domains.
- Review process execution logs and temporary file creation for suspicious activity matching the described binary names and execution patterns.
- Update to a patched version of the package if available, or replace with an alternative trusted package.
- Monitor for network connections to oob-worker.cf101-adf.workers.dev, cf103-070/cf102-baf/cf99-9b3.workers.dev, and win.dl.well1.site.
- Regenerate any credentials or secrets that may have been exposed on affected systems.
Sources
- GitHub Advisory GHSA-9mcv-4v2c-mv32 · GitHub Advisory Database
Cite this entry
"Malicious code in shopping-shared-atom-mobile-cart-counter (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-shopping-shared-atom-mobile-cart-counter-npm-12q2zn
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in supersig (npm)
The supersig npm package contains malicious code in its published dist bundles (dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js) that is absent from the source tree. The bundles execute a decrypt-and-execute chain at load time using a DES key from an unpinned mkb-manager dependency, allowing remote code execution on any consumer.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in zyr-agent (npm)
zyr-agent (npm) shipped with malicious code that enables remote command execution through a hardcoded preview-slug endpoint controlled by the package author. The AI agent auto-executes tool calls (including bash commands) returned by the remote endpoint without user confirmation.
npmAI agents & skillsMalicious commitCompromised package - resolvedcritical
Malicious code in stretchshop (npm)
The npm package stretchshop@0.7.5 contained malicious code in its postinstall hook that cloned an external repository from a personal GitHub account and executed arbitrary JavaScript during installation. The vulnerability allowed the controller of the external repository to execute code on every fresh install of the affected version.
npmCompromised packageMalicious commit - containedcritical
Malicious code in gpt-terminal-cli (npm)
gpt-terminal-cli, an npm package advertised as an AI chat CLI, contains malicious code that installs a persistent remote access implant with extensive capabilities including reverse shell, credential theft, keylogging, and antiforensics. The implant communicates with a hardcoded C2 server and supports dynamic C2 rotation via DNS dead-drop.
npmCompromised packageMalicious commit