Malicious code in squeez (npm)
squeez@1.38.0 on npm contains malicious code in a postinstall hook that performs home-directory reconnaissance and fetches executable content from mutable GitHub URLs at install time. The package implements an install-time remote-content-fetch-and-execute pattern with capability to spawn child processes.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed squeez@1.38.0
- Ecosystems
- Attack vectors
- Affected entities
- squeez · 1.38.0
squeez@1.38.0 declares a postinstall lifecycle script ("postinstall": "node install.js") that executes automatically during npm install. The install.js script imports child_process, fs, https, and os modules, enabling process spawning and network requests.
The malicious behavior includes platform-specific branching, filesystem reconnaissance of the user's home directory (via os.homedir(), fs.existsSync, and fs.readFileSync), and HTTPS requests to raw.githubusercontent.com URLs. This combination constitutes an install-time remote-content-fetch-and-execute pattern.
The use of raw.githubusercontent.com as a delivery channel is particularly dangerous because the content at those URLs can change at any time without a package release, and the fetched bytes are executed within a script context that has child_process capabilities available. This creates an unpinned, mutable attack surface.
The malicious package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- squeez@1.38.0
Remediation
- Immediately uninstall squeez@1.38.0 and any affected versions
- Audit npm install logs and process history for suspicious activity during the installation window
- Review home directory for unauthorized access or modifications
- Check for unexpected network connections or data exfiltration from the affected system
- Update to a patched version of squeez if available, or use an alternative package
- Consider using npm audit to identify other potentially compromised dependencies
Sources
- GitHub Advisory GHSA-gxp9-8gvx-q8cq · GitHub Advisory Database
Cite this entry
"Malicious code in squeez (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-squeez-npm-cz0vqd
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - containedcritical
Malware in @siwatfa/yorn
Malware was discovered in the npm package @siwatfa/yorn. Systems with this package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different computer.
npmCompromised package - containedcritical
Malicious code in checkout-desktop-total (npm)
The npm package checkout-desktop-total contained malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under wel1.ru. Any system that imported this package should be considered compromised.
npmCompromised package