Malicious code in tfjs-custom-module (npm)
tfjs-custom-module is a typosquat package on npm containing malicious code that exfiltrates host reconnaissance data via a postinstall script to an attacker-controlled domain.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed tfjs-custom-module
- Ecosystems
- Attack vectors
- Affected entities
- tfjs-custom-moduleTyposquat of tensorflow/tfjs package
tfjs-custom-module is a typosquatting attack targeting the legitimate tensorflow/tfjs package on npm. The malicious package includes a postinstall lifecycle script that executes automatically upon installation without user consent.
The postinstall script collects host reconnaissance information including the system hostname, platform, architecture, Node.js version, package name, and npm lifecycle event. This data is then exfiltrated via HTTPS POST request to a hardcoded external domain (8xq4kw5d.instances.poc.jchunt.top) at the path /tfjs-custom-module.
The attacker-controlled endpoint is not associated with the installer's legitimate infrastructure, and the data collection is not opt-in. The use of a look-alike canary domain further indicates malicious intent despite any claims of security research.
The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- tfjs-custom-module
- Domains
- 8xq4kw5d.instances.poc.jchunt.top
Remediation
- Immediately uninstall tfjs-custom-module from all systems
- Audit npm install logs to identify systems that installed the malicious package
- Review network logs for connections to 8xq4kw5d.instances.poc.jchunt.top
- Use the legitimate tensorflow/tfjs package instead
- Implement npm package name verification and typosquat detection in dependency management
- Consider using npm audit or similar tools to detect known malicious packages
Sources
- GitHub Advisory GHSA-4ccr-vjmw-rf6f · GitHub Advisory Database
Cite this entry
"Malicious code in tfjs-custom-module (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-tfjs-custom-module-npm-19jjfu
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package