Malicious code in @sidp-kiosk/test-npm-snurkeburk-hackerone (npm)
The npm package @sidp-kiosk/test-npm-snurkeburk-hackerone contained malicious code that executed automatically on installation via a preinstall script. The script exfiltrated host identifiers (hostname, username, working directory) and public IP address through DNS tunneling to attacker-controlled infrastructure.
- Disclosed
- Last updated
- Blast radius
- All users who installed the malicious package versions
- Ecosystems
- Attack vectors
- Affected entities
- @sidp-kiosk/test-npm-snurkeburk-hackerone
The npm package @sidp-kiosk/test-npm-snurkeburk-hackerone was found to contain malicious code in its preinstall script. Upon installation via npm install, the package automatically executed index.js, which used child_process.exec to gather sensitive host information.
The malicious script collected the installer's hostname, current working directory, username, a package marker, and the machine's public IP address (fetched via curl to ifconfig.me). This data was then hex-encoded using xxd and split into DNS labels for exfiltration.
The exfiltration mechanism used DNS tunneling via nslookup queries against subdomains of snurkeburk.com, an attacker-controlled DNS namespace. This technique bypasses traditional egress HTTP filtering, allowing the attacker to receive host identifiers and IP information from compromised systems.
The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @sidp-kiosk/test-npm-snurkeburk-hackerone
- Domains
- snurkeburk.com
Remediation
- Remove the @sidp-kiosk/test-npm-snurkeburk-hackerone package from all projects immediately
- Audit npm install logs and network traffic for DNS queries to snurkeburk.com subdomains
- Review systems that installed this package for signs of compromise or data exfiltration
- Check for unauthorized access or lateral movement from affected systems
- Update npm dependencies to remove any references to this malicious package
- Consider rotating credentials and reviewing access logs on affected systems
Sources
- GitHub Advisory GHSA-3327-vf49-6qw2 · GitHub Advisory Database
Cite this entry
"Malicious code in @sidp-kiosk/test-npm-snurkeburk-hackerone (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-sidp-kiosk-test-npm-snurkeburk-hackerone-npm-uvuci5
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package