Malicious code in stretchshop (npm)
The npm package stretchshop@0.7.5 contained malicious code in its postinstall hook that cloned an external repository from a personal GitHub account and executed arbitrary JavaScript during installation. The vulnerability allowed the controller of the external repository to execute code on every fresh install of the affected version.
- Disclosed
- Last updated
- Blast radius
- All users installing stretchshop@0.7.5 via npm
- Ecosystems
- Attack vectors
- Affected entities
- stretchshop · 0.7.5
The npm package stretchshop@0.7.5 declared a postinstall hook in package.json that executed node demo/demo.js base. This script performed a shell invocation to clone a repository from https://github.com/Wradgio/StretchShop-demo-data.git at the mutable HEAD (without specifying a commit SHA, tag, or integrity check), then used childProcess.fork() to execute db/demo_data.js from the freshly cloned repository.\n\nThe critical issue is that the cloned repository is owned by the personal GitHub account Wradgio, which does not match the package's publisher scope StretchShop. This mismatch means that whoever controls the Wradgio GitHub account could push arbitrary JavaScript to the default branch of that repository and have it automatically executed on every fresh top-level installation of stretchshop.\n\nThis attack vector combines a compromised postinstall hook with a dependency on an untrusted external source, allowing arbitrary code execution during package installation without user awareness or consent.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages project.
Indicators of compromise
- Packages
- stretchshop@0.7.5
- Domains
- github.com/Wradgio/StretchShop-demo-data.git
Remediation
- Remove stretchshop@0.7.5 from all environments immediately
- Audit any systems where stretchshop@0.7.5 was installed for signs of compromise or unauthorized code execution
- Review the GitHub repository Wradgio/StretchShop-demo-data for any malicious commits that may have been pushed
- Use npm audit to identify affected installations
- Update to a patched version of stretchshop if available, or use an alternative package
- Consider implementing postinstall hook restrictions or using npm's --ignore-scripts flag during installation
Sources
- GitHub Advisory GHSA-hjhp-x4x6-fq56 · GitHub Advisory Database
Cite this entry
"Malicious code in stretchshop (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-stretchshop-npm-864opv
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit