Malicious code in text-line-parser (npm)
The npm package text-line-parser contained malicious code in its postinstall.js that collected system information, environment variables (including CI tokens and cloud credentials), and exfiltrated them to a Burp Collaborator domain. The package advertised itself as a text-parsing utility but shipped only stub functions, consistent with a typosquat/decoy supply-chain attack.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed text-line-parser via npm; credentials and environment variables exposed to attacker-controlled domain.
- Ecosystems
- Attack vectors
- Affected entities
- text-line-parsernpm package containing malicious postinstall.js
The npm package text-line-parser was identified as malicious by Amazon Inspector and the OpenSSF malicious-packages repository. The package advertised itself as a text/line parsing utility but its shipped index.js contained only unrelated color-conversion stub functions (hexToRgb/rgbToHsl).\n\nUpon installation via npm install, the postinstall.js script executed a shell pipeline that collected extensive system reconnaissance data: hostname, user, current working directory, uname output, Docker environment indicators (/proc/1/cgroup, /.dockerenv), process tree, local IP addresses, and DNS nameserver configuration. The script also probed Tencent Cloud and AWS IMDS cloud-metadata endpoints.\n\nThe collected data was combined with the full process environment (capturing CI tokens, cloud credentials, and API keys) and GitHub Actions identifiers (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID, CI, RUNNER_NAME). This payload was base64-encoded and exfiltrated via HTTP to the hardcoded Burp Collaborator subdomain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com.\n\nThe mismatch between the advertised text-parsing functionality and the shipped reconnaissance/exfiltration code is consistent with a typosquat or decoy supply-chain attack designed to harvest credentials and sensitive environment data from developer machines and CI/CD systems.
Indicators of compromise
- Packages
- text-line-parser
- Domains
- pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com
Remediation
- Immediately uninstall text-line-parser from all systems and CI/CD pipelines
- Rotate all credentials, API keys, and tokens that may have been exposed (GitHub tokens, cloud credentials, npm tokens, etc.)
- Review npm install logs and CI/CD execution logs for evidence of postinstall.js execution
- Audit environment variables and secrets that were present during any npm install of this package
- Add text-line-parser to package blocklists and dependency scanning tools
- Monitor for suspicious outbound connections to pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com in network logs
Sources
- GitHub Advisory GHSA-hp3v-hcrw-9mf8 · GitHub Advisory Database
Cite this entry
"Malicious code in text-line-parser (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-text-line-parser-npm-16mb9i
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @coralxyz/anchor (npm)
The npm package @coralxyz/anchor is a typosquatting attack impersonating the legitimate @coral-xyz/anchor Solana framework. It contains a postinstall hook that downloads and executes a malicious executable on Windows systems. The package provides no legitimate functionality and serves solely as a dropper for malware.
npmTyposquattingCompromised package - containedcritical
Malicious code in @nestjs-passport/jwt (npm)
A malicious npm package @nestjs-passport/jwt was published under a scope resembling official NestJS packages. The package contains JSFuck-encoded obfuscated code (~2.3MB) that executes hidden functionality at require/import time in the installer's Node process.
npmTyposquattingCompromised package - containedcritical
Malicious code in dolyame-ui-datatable (npm)
The npm package dolyame-ui-datatable contains malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure. The package is a typosquat/dependency-confusion carrier with no legitimate UI or datatable functionality, only loader and dropper code.
npmCompromised packageTyposquatting - activecritical
Malicious code in hardhat-set (npm)
The npm package hardhat-set contains malicious obfuscated code disguised with a copied pino logger README. The package executes a multi-megabyte obfuscated payload on import, delivering hidden malware to anyone who installs or requires it.
npmTyposquattingCompromised package