Malicious code in text-line-parser (npm)
The npm package text-line-parser contained malicious code in its postinstall.js that collected system information, environment variables (including CI tokens and cloud credentials), and exfiltrated them to a Burp Collaborator domain. The package advertised itself as a text-parsing utility but shipped only stub functions, consistent with a typosquat/decoy supply-chain attack.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed text-line-parser via npm; credentials and environment variables exposed to attacker-controlled domain.
- Ecosystems
- Attack vectors
- Affected entities
- text-line-parsernpm package containing malicious postinstall.js
The npm package text-line-parser was identified as malicious by Amazon Inspector and the OpenSSF malicious-packages repository. The package advertised itself as a text/line parsing utility but its shipped index.js contained only unrelated color-conversion stub functions (hexToRgb/rgbToHsl).\n\nUpon installation via npm install, the postinstall.js script executed a shell pipeline that collected extensive system reconnaissance data: hostname, user, current working directory, uname output, Docker environment indicators (/proc/1/cgroup, /.dockerenv), process tree, local IP addresses, and DNS nameserver configuration. The script also probed Tencent Cloud and AWS IMDS cloud-metadata endpoints.\n\nThe collected data was combined with the full process environment (capturing CI tokens, cloud credentials, and API keys) and GitHub Actions identifiers (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID, CI, RUNNER_NAME). This payload was base64-encoded and exfiltrated via HTTP to the hardcoded Burp Collaborator subdomain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com.\n\nThe mismatch between the advertised text-parsing functionality and the shipped reconnaissance/exfiltration code is consistent with a typosquat or decoy supply-chain attack designed to harvest credentials and sensitive environment data from developer machines and CI/CD systems.
Indicators of compromise
- Packages
- text-line-parser
- Domains
- pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com
Remediation
- Immediately uninstall text-line-parser from all systems and CI/CD pipelines
- Rotate all credentials, API keys, and tokens that may have been exposed (GitHub tokens, cloud credentials, npm tokens, etc.)
- Review npm install logs and CI/CD execution logs for evidence of postinstall.js execution
- Audit environment variables and secrets that were present during any npm install of this package
- Add text-line-parser to package blocklists and dependency scanning tools
- Monitor for suspicious outbound connections to pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com in network logs
Sources
- GitHub Advisory GHSA-hp3v-hcrw-9mf8 · GitHub Advisory Database
Cite this entry
"Malicious code in text-line-parser (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-text-line-parser-npm-16mb9i
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in sigchain-js (npm)
Malicious code was injected into the published npm package sigchain-js, executing arbitrary code on installation via DES-decrypted payloads from companion packages thedata and tchain-api. The attack also involved typosquatting axios to version 1.18.1, which does not exist in legitimate release history.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in rollup-runtime-core-polyfills (npm)
The npm package rollup-runtime-core-polyfills contained malicious code that impersonated a legitimate rollup polyfill plugin. On every import/require, it decoded and executed a shell command to install an attacker-controlled package (svgcraft-core) and executed code from it, affecting any build system that consumed this package.
npmCompromised packageTyposquatting - containedcritical
Malicious code in @ai_/autoprefixers (npm)
@ai_/autoprefixers is a typosquat of the legitimate autoprefixer package that executes arbitrary attacker-controlled shell commands on installation. The malicious code fetches encrypted payloads from remote C2 servers and decrypts them using a hardcoded key suffix before execution via child_process.exec.
npmTyposquattingCompromised package - containedcritical
Malicious code in parallely (npm)
The npm package parallely contains malicious code that impersonates the legitimate concurrently package. When invoked, it executes a dropper that downloads and runs platform-specific payloads after anti-analysis checks.
npmCompromised packageTyposquatting