Malicious code in tfjs-inference (npm)
The npm package tfjs-inference is a typosquatting attack on TensorFlow.js that executes a postinstall script to exfiltrate installer host identifiers (hostname, platform, arch, Node.js version, package name) to a third-party server without user consent.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed tfjs-inference
- Ecosystems
- Attack vectors
- Affected entities
- tfjs-inferenceTyposquatting package for TensorFlow.js
The malicious npm package tfjs-inference typosquats the legitimate TensorFlow.js library. Upon installation, the package's postinstall lifecycle script automatically executes and collects sensitive host identifiers including hostname, platform, architecture, Node.js version, and package name.
The collected data is exfiltrated via HTTP POST as JSON to a hardcoded third-party domain (zl2u2d1x.instances.poc.jchunt.top) at the path /tfjs-inference. This data collection occurs automatically on npm install with no user opt-in, configuration option, or consent prompt.
Internal code comments label the package as a security research canary, but the destination server is author-controlled and users receive no notification of the data collection. The attack was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- tfjs-inference
- Domains
- zl2u2d1x.instances.poc.jchunt.top
Remediation
- Immediately uninstall tfjs-inference from all systems: `npm uninstall tfjs-inference`
- Install the legitimate TensorFlow.js package instead: `npm install @tensorflow/tfjs`
- Audit npm install logs and network traffic for connections to zl2u2d1x.instances.poc.jchunt.top
- Review and rotate any credentials or sensitive information that may have been exposed on affected systems
- Use npm audit to check for other malicious packages
- Consider using npm package name verification tools and typosquatting detection in your supply chain
Sources
- GitHub Advisory GHSA-697f-wmcx-8jq7 · GitHub Advisory Database
Cite this entry
"Malicious code in tfjs-inference (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-tfjs-inference-npm-1eec7v
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package