Malicious code in sso-tramvai-module-context-auth (npm)
The npm package sso-tramvai-module-context-auth contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure upon require(). The package name mimics the legitimate tramvai ecosystem to evade detection.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that installed sso-tramvai-module-context-auth
- Ecosystems
- Attack vectors
- Affected entities
- sso-tramvai-module-context-authnpm package containing malicious code
The npm package sso-tramvai-module-context-auth was found to contain malicious code that executes on module load. When required, the package's index.js loads _vendor.js, which reconstructs attacker-controlled hostnames (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, with a *.dl.well1.site DNS-TXT fallback channel) to evade static string matching detection.
The malicious code downloads a platform-specific binary and writes it to /var/tmp/.cache_ on Unix systems or %TEMP%/dotnet_diag_.exe on Windows, then executes it detached from the Node process using shell commands (/bin/sh -c or cmd.exe /c start /b) with stdio redirected. The execution is gated by opt-out environment variables and a TTL-based state-file cache to reduce visibility of repeated execution.
The package name closely resembles legitimate packages in the tramvai ecosystem, likely intended to deceive developers. The fetched binary, its command-and-control infrastructure, and the drop-and-execute behavior are unrelated to any authentication token functionality that the package advertises.
This incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-frm7-83xc-2wp6.
Indicators of compromise
- Packages
- sso-tramvai-module-context-auth
- Domains
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf103-070.workers.dev
- oob-worker.cf99-9b3.workers.dev
- *.dl.well1.site
Remediation
- Immediately remove sso-tramvai-module-context-auth from all projects and dependencies
- Audit npm package.json and lock files for any presence of this package
- Review application logs and system logs for evidence of binary execution from /var/tmp/.cache_ or %TEMP%/dotnet_diag_.exe
- Regenerate any credentials or tokens that may have been exposed on affected systems
- Use legitimate tramvai ecosystem packages only; verify package names and publishers carefully
- Implement npm package scanning and allowlisting to prevent installation of typosquatted or malicious packages
- Monitor for similar typosquatting attempts targeting the tramvai ecosystem
Sources
- GitHub Advisory GHSA-frm7-83xc-2wp6 · GitHub Advisory Database
Cite this entry
"Malicious code in sso-tramvai-module-context-auth (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-sso-tramvai-module-context-auth-npm-18oueb
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in express-chai (npm)
express-chai, a malicious npm package impersonating the pino logger middleware, contained obfuscated code that fetches and executes arbitrary code from a remote server (https://gray-dyane-31.tiiny.site/index.json) at middleware initialization time, granting full Node.js process access to an attacker.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in helmet-pro (npm)
helmet-pro@10.0.4 is a typosquat of the legitimate helmet package that executes malicious code during npm install via a postinstall hook. The malicious code fetches and executes arbitrary JavaScript from a remote attacker-controlled endpoint, enabling remote code execution on the installer's machine.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in tailwindcss-hide-scrollbar (npm)
The npm package tailwindcss-hide-scrollbar contains malicious code that executes on import/require. The package is a typosquat of the legitimate tailwind-scrollbar-hide plugin and includes obfuscated code that attempts to interact with Ethereum blockchain nodes and RPC endpoints.
npmTyposquattingCompromised package - containedcritical
Malicious code in @atom8n/inspector (npm)
The npm package @atom8n/inspector contained malicious code that impersonated Anthropic's official Model Context Protocol (MCP) inspector while intentionally disabling security protections. The package exposed developers to arbitrary remote code execution via a localhost proxy that accepted commands from any web origin.
npmModel hubCompromised packageTyposquatting