Malicious code in simple-probe-utils (npm)
The npm package simple-probe-utils contained malicious postinstall code that harvested cloud provider credentials (AWS IAM, Tencent, Aliyun, GCP, Azure) and exfiltrated them to an attacker-controlled domain. The package was masqueraded as a string formatting utility but contained only credential-stealing functionality.
- Disclosed
- Last updated
- Blast radius
- Any npm user installing simple-probe-utils; credential exposure affects AWS, Tencent, Aliyun, GCP, and Azure cloud environments.
- Ecosystems
- Attack vectors
- Affected entities
- simple-probe-utilsnpm package containing malicious postinstall script
The npm package simple-probe-utils was published with malicious postinstall.js code that executes during package installation. The script queries cloud instance metadata services across multiple providers: AWS IMDS (169.254.169.254), Tencent, Aliyun, GCP, and Azure endpoints.\n\nThe harvested data includes AWS IAM role temporary security credentials, hostname, and username. These credentials are exfiltrated via HTTP request to a hardcoded out-of-band domain: pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com (a Burp Collaborator-style infrastructure).\n\nThe package.json falsely describes the module as a lightweight string formatting helper, but the shipped code contains no string-utility functionality—only the credential-harvesting postinstall script. This represents a supply chain attack targeting developers and systems with cloud credentials accessible via instance metadata services.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- simple-probe-utils
- Domains
- pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com
- IPs
- 169.254.169.254
Remediation
- Immediately uninstall simple-probe-utils from all systems and projects
- Audit npm install logs to identify affected installations
- Rotate all AWS IAM credentials, especially those used in development or CI/CD environments
- Rotate credentials for Tencent, Aliyun, GCP, and Azure accounts if accessed from affected systems
- Review cloud provider audit logs for unauthorized API calls using potentially compromised credentials
- Implement npm package scanning and verification in CI/CD pipelines
- Use npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-9j4g-h77m-3g6m · GitHub Advisory Database
Cite this entry
"Malicious code in simple-probe-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-simple-probe-utils-npm-1g8kq2
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
npmCompromised package