Malicious code in sm-checkout (npm)
Malicious npm package sm-checkout versions 99.0.0 and 99.0.1 contained preinstall and postinstall lifecycle scripts that executed curl commands to beacon to a hardcoded IP address (16.192.173.5) over plain HTTP, leaking installer source IP and timing. The inflated version number was designed to win semver resolution against a private package of the same name in a dependency-confusion attack.
- Disclosed
- Last updated
- Blast radius
- Any developer or build system that installed sm-checkout@99.0.0 or sm-checkout@99.0.1 from npm.
- Ecosystems
- Attack vectors
- Affected entities
- sm-checkout · 99.0.0, 99.0.1
The npm package sm-checkout versions 99.0.0 and 99.0.1 were identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project. The package contained preinstall and postinstall lifecycle scripts in package.json that invoked curl against hardcoded bare-IP URLs over plain HTTP: http://16.192.173.5/sm-checkout/pre and http://16.192.173.5/sm-checkout/post.
The attack leveraged a dependency-confusion vector: the inflated version number (99.0.0) was calibrated to win semver resolution against a private package of the same name, causing build systems and developer machines to mistakenly resolve the public malicious package instead of the intended private one. The lifecycle callbacks executed on every npm install, beaconing to the attacker-controlled IP address and leaking the installer's source IP and install timing.
A source comment in the package self-labeled it as a dependency-confusion test, indicating intentional malicious behavior. The package was identified and cataloged by the OpenSSF malicious packages project (MAL-2026-14397).
Indicators of compromise
- Packages
- sm-checkout
- IPs
- 16.192.173.5
Remediation
- Immediately remove sm-checkout@99.0.0 and sm-checkout@99.0.1 from all package.json files and lock files
- Audit npm install logs and build system logs for any outbound connections to 16.192.173.5 to identify affected installations
- Regenerate any credentials or secrets that may have been exposed on machines where the package was installed
- Review private package registry configurations to ensure proper authentication and access controls are in place to prevent dependency-confusion attacks
- Use npm audit to scan for any remaining malicious packages
- Consider implementing package signature verification and allowlisting for critical dependencies
Sources
- GitHub Advisory GHSA-pxgj-j29f-m7fq · GitHub Advisory Database
Cite this entry
"Malicious code in sm-checkout (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 24, 2026; last updated August 24, 2026. https://supplychainattack.org/incident/malicious-code-in-sm-checkout-npm-5m8eoi
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in amundi-compare (npm)
Malicious npm package amundi-compare@999.9.12 published at an inflated version number as a dependency-confusion attack. The package executes a preinstall hook that exfiltrates system and project metadata via HTTP, HTTPS, and DNS covert channels to da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in fund-calculator (npm)
Malicious npm package fund-calculator (version 999.9.12) contained a preinstall script that collected system and project metadata from installers and exfiltrated it via HTTP, HTTPS, and DNS to a hardcoded callback domain. The package was designed as a dependency-confusion attack to shadow an internal private package.
npmCompromised packageDependency confusion - activecritical
Malicious code in sm-billing-form (npm)
Malicious npm package sm-billing-form (versions 99.0.0 and 99.0.1) contains preinstall and postinstall lifecycle scripts that execute curl commands to a hardcoded IP address (16.192.173.5) over cleartext HTTP, exfiltrating install environment details. The high version number and behavior pattern indicate a dependency-confusion attack targeting internal packages of the same name.
npmCompromised packageDependency confusion - containedcritical
Malicious code in sm-cart (npm)
Malicious npm package sm-cart (versions 99.0.0 and 99.0.1) uses dependency confusion and preinstall/postinstall scripts to beacon to a hardcoded IP address (16.192.173.5) over plain HTTP, disclosing the installing host's public IP and successful installation. The package is designed to win resolution when an organization has an internal package with the same name.
npmDependency confusionCompromised package