Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in shopping-shared-atom-mobile-cart-counter (npm)

shopping-shared-atom-mobile-cart-counter@20.6.6 (npm) contains malicious code that downloads and executes platform-specific binaries at runtime via obfuscated C2 communication, disguised as telemetry/analytics functionality.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any application using shopping-shared-atom-mobile-cart-counter@20.6.6 in npm environments (Node.js, Electron, bundled web applications).
Ecosystems
Attack vectors
Affected entities
  • shopping-shared-atom-mobile-cart-counter · 20.6.6

The npm package shopping-shared-atom-mobile-cart-counter version 20.6.6 contains malicious code injected into its loader.js module. The loader is executed at require() time and constructs command-and-control (C2) hostnames dynamically using array-join operations to evade static analysis detection.\n\nThe malicious code downloads platform-specific binaries from C2 servers (including oob-worker.cf101-adf.workers.dev and cf103-070/cf102-baf/cf99-9b3.workers.dev) and writes them to temporary directories (/var/tmp on Unix, %TEMP% on Windows) under disguised filenames such as dotnet_diag.exe or .cache_. The binaries are then executed detached via shell commands (/bin/sh -c on Unix, cmd /c start on Windows).\n\nThe attack uses a cover story of telemetry and analytics collection, with marker files and environment variables (DISABLE_TELEMETRY, DO_NOT_TRACK) providing plausible deniability. The fetched binaries are opaque and unrelated to the package's stated purpose as a mobile cart-counter component. A DNS-TXT chunked fallback mechanism under win.dl.well1.site provides redundant C2 communication.\n\nThis incident was identified by the OpenSSF malicious-packages project and published via GitHub Security Advisory GHSA-9mcv-4v2c-mv32.

Indicators of compromise

Packages
  • shopping-shared-atom-mobile-cart-counter
Domains
  • oob-worker.cf101-adf.workers.dev
  • cf103-070/cf102-baf/cf99-9b3.workers.dev
  • win.dl.well1.site

Remediation

  • Immediately remove shopping-shared-atom-mobile-cart-counter@20.6.6 from all dependencies and lock files.
  • Audit all applications that installed this package version for signs of unauthorized binary execution or network connections to the identified C2 domains.
  • Review process execution logs and temporary file creation for suspicious activity matching the described binary names and execution patterns.
  • Update to a patched version of the package if available, or replace with an alternative trusted package.
  • Monitor for network connections to oob-worker.cf101-adf.workers.dev, cf103-070/cf102-baf/cf99-9b3.workers.dev, and win.dl.well1.site.
  • Regenerate any credentials or secrets that may have been exposed on affected systems.

Sources

  1. GitHub Advisory GHSA-9mcv-4v2c-mv32 · GitHub Advisory Database

Cite this entry

"Malicious code in shopping-shared-atom-mobile-cart-counter (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-shopping-shared-atom-mobile-cart-counter-npm-12q2zn

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. containedcritical

    Malicious code in pfp-forms-sme-loan (npm)

    The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.

    npmCompromised packageMalicious commit
  2. resolvedcritical

    Malicious code in twilio-hackerone-poc-afe6937c (npm)

    The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.

    npmCompromised packageMalicious commit
  3. containedcritical

    Malicious code in @wololasod/tiny-id (npm)

    The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.

    npmCompromised packageMalicious commit
  4. containedcritical

    Malicious code in akamaijs-sensor (npm)

    The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.

    npmCompromised packageMalicious commit