Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in ssb-test-package (npm)

ssb-test-package@1.0.0 on npm contains malicious code designed as a dependency-confusion proof-of-concept. A preinstall hook executes arbitrary code on installation, performing host reconnaissance and writing results to a local file.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or CI/CD system that installs ssb-test-package@1.0.0 from npm.
Ecosystems
npm
Attack vectors
Compromised packageDependency confusion
Affected entities
  • ssb-test-package · 1.0.0

ssb-test-package@1.0.0 is a malicious npm package published as a dependency-confusion proof-of-concept. The package.json declares a preinstall hook that runs node poc.js unconditionally during npm install.

The poc.js script performs host reconnaissance, collecting OS user, hostname, platform, architecture, Node version, current working directory, and non-internal network interface addresses. This data is written to a JSON object with rce_status: "CONFIRMED" and saved to /tmp/npm-dependency-confusion-rce-poc.json.

The package contains no legitimate functionality: package.json declares main: index.js, but index.js is absent from the tarball. Only package.json and poc.js are shipped. The package self-identifies as a PoC for npm dependency confusion using a look-alike internal name.

While the current build does not exfiltrate data over the network, the preinstall hook demonstrates arbitrary code execution on the installer's host at install time. The package was identified by the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • ssb-test-package@1.0.0

Remediation

  • Remove ssb-test-package from all dependencies and lock files
  • Audit npm install logs and CI/CD logs for execution of this package between publication and removal
  • Review host reconnaissance data if /tmp/npm-dependency-confusion-rce-poc.json exists on affected systems
  • Implement npm package allow-listing or dependency verification to prevent installation of unexpected packages
  • Monitor for similar dependency-confusion attacks targeting internal package names

Sources

  1. GitHub Advisory GHSA-395g-xx9j-mgx7 · GitHub Advisory Database

Cite this entry

"Malicious code in ssb-test-package (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-ssb-test-package-npm-1oqq6b

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  2. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  3. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion
  4. resolvedcritical

    Malicious code in @gfe/lx-watcher (npm)

    The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.

    npmDependency confusionCompromised package