Malicious code in sm-session (npm)
The npm package sm-session (version 99.0.1) contains malicious preinstall and postinstall lifecycle scripts that beacon to a hardcoded IP address (16.192.173.5) over plain HTTP, exfiltrating installer host information. This is a dependency-confusion reconnaissance attack designed to identify which environments resolve the package name.
- Disclosed
- Last updated
- Blast radius
- All npm environments that installed sm-session, particularly version 99.0.1
- Ecosystems
- Attack vectors
- Affected entities
- sm-session · 99.0.1
The npm package sm-session version 99.0.1 was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project. The package contains preinstall and postinstall lifecycle scripts that execute curl commands to http://16.192.173.5/sm-session/pre and http://16.192.173.5/sm-session/post respectively.
These scripts execute automatically on npm install, causing the installer's host information (source IP, user-agent, timing) to be transmitted to an operator-controlled endpoint over plain HTTP. The hardcoded bare IPv4 address and path segments identifying the package name and lifecycle stage indicate this is reconnaissance activity.
The behavior is consistent with a dependency-confusion attack: a name-squat package whose sole install-time action is to callback and identify which environments resolve the name. No legitimate package functionality is served by these beacons.
The package has been identified and flagged by security researchers, and the malicious behavior is well-documented in the OpenSSF malicious packages repository.
Indicators of compromise
- Packages
- sm-session@99.0.1
- IPs
- 16.192.173.5
Remediation
- Immediately uninstall sm-session from all environments
- Audit npm install logs and network traffic for connections to 16.192.173.5
- Review and rotate credentials and secrets that may have been exposed on affected systems
- Implement npm package allow-listing or use a private registry to prevent installation of untrusted packages
- Monitor for any suspicious activity originating from affected hosts
- Update npm and use `npm audit` to detect similar malicious packages
Sources
- GitHub Advisory GHSA-wm74-4gpw-8fm5 · GitHub Advisory Database
Cite this entry
"Malicious code in sm-session (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 24, 2026; last updated August 24, 2026. https://supplychainattack.org/incident/malicious-code-in-sm-session-npm-1pighh
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in amundi-compare (npm)
Malicious npm package amundi-compare@999.9.12 published at an inflated version number as a dependency-confusion attack. The package executes a preinstall hook that exfiltrates system and project metadata via HTTP, HTTPS, and DNS covert channels to da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in fund-calculator (npm)
Malicious npm package fund-calculator (version 999.9.12) contained a preinstall script that collected system and project metadata from installers and exfiltrated it via HTTP, HTTPS, and DNS to a hardcoded callback domain. The package was designed as a dependency-confusion attack to shadow an internal private package.
npmCompromised packageDependency confusion - activecritical
Malicious code in sm-billing-form (npm)
Malicious npm package sm-billing-form (versions 99.0.0 and 99.0.1) contains preinstall and postinstall lifecycle scripts that execute curl commands to a hardcoded IP address (16.192.173.5) over cleartext HTTP, exfiltrating install environment details. The high version number and behavior pattern indicate a dependency-confusion attack targeting internal packages of the same name.
npmCompromised packageDependency confusion - containedcritical
Malicious code in sm-cart (npm)
Malicious npm package sm-cart (versions 99.0.0 and 99.0.1) uses dependency confusion and preinstall/postinstall scripts to beacon to a hardcoded IP address (16.192.173.5) over plain HTTP, disclosing the installing host's public IP and successful installation. The package is designed to win resolution when an organization has an internal package with the same name.
npmDependency confusionCompromised package