Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer whose resolver falls through to the public registry and lacks internal package shadowing; impact includes host identity and project metadata exfiltration.
- Ecosystems
- Attack vectors
- Affected entities
- stillm4ddpocs-demo-sprocket · 999.9.12
The npm package stillm4ddpocs-demo-sprocket (version 999.9.12) was published with embedded malicious code designed to exfiltrate sensitive information during installation. The package.json declares a preinstall script that executes index.js, which collects system and project metadata without user consent.
The malicious payload gathers hostname, username, home directory, current working directory, local IPv4 address, public IP address (via external APIs: api.ipify.org, icanhazip.com, ifconfig.me), DNS resolver information, and consuming project metadata (package name, author, repository, homepage). This data is transmitted to the hardcoded callback host da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun using multiple exfiltration channels: HTTPS POST, HTTP POST to /poc/, and a covert DNS channel that hex-encodes payloads in DNS queries to bypass egress filtering.
The package employs a canonical dependency-confusion attack strategy: the artificially high version number (999.9.12) is explicitly chosen to ensure npm resolves the public malicious copy over any internal package with the same name. This targets organizations that maintain private packages but lack proper registry configuration or fallback controls.
The incident was identified and credited to the OpenSSF's malicious-packages project.
Indicators of compromise
- Packages
- stillm4ddpocs-demo-sprocket
- Domains
- da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun
Remediation
- Immediately remove stillm4ddpocs-demo-sprocket from all package.json files and lock files
- Audit npm install logs and network traffic for connections to da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun
- Review system and project metadata that may have been exfiltrated (hostname, username, project names, repository URLs)
- Implement strict npm registry configuration with private registry fallback to prevent dependency-confusion attacks
- Use npm audit and supply-chain security tools to detect similar malicious packages
- Consider rotating credentials and secrets if systems were compromised during the installation window
- Block outbound connections to the callback domain at network perimeter
Sources
- GitHub Advisory GHSA-6cpg-8367-hp87 · GitHub Advisory Database
Cite this entry
"Malicious code in stillm4ddpocs-demo-sprocket (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 23, 2026; last updated August 23, 2026. https://supplychainattack.org/incident/malicious-code-in-stillm4ddpocs-demo-sprocket-npm-r14gk6
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in lumen-pages-community (npm)
lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in @gfe/lx-watcher (npm)
The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in gemini-cli-a2a-server (npm)
A malicious npm package named gemini-cli-a2a-server was published to exploit dependency confusion, mimicking a private Google internal component. The postinstall script collected host identifiers and exfiltrated them to a hardcoded external endpoint.
npmDependency confusionCompromised package