Malicious code in tidal-embed-player (npm)
The npm package tidal-embed-player contained malicious code that executed on installation, collecting host identifiers and system files, then exfiltrating the data to an attacker-controlled domain. The package had no legitimate functionality despite its name suggesting a Tidal media player.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed tidal-embed-player via npm
- Ecosystems
- Attack vectors
- Affected entities
- tidal-embed-playernpm package containing malicious preinstall hook
The npm package tidal-embed-player was published with malicious code embedded in its preinstall hook. When installed via npm install, the package.json declared a preinstall script that executed index.js before the package was fully installed.
The malicious index.js performed host reconnaissance by collecting sensitive system information including hostname, username, home directory, DNS servers, current working directory, and the contents of package.json. It also read system files /etc/passwd and /etc/hosts from the installer's host.
All collected data was exfiltrated via HTTPS POST request to 1rtlwocct2ruj1kc2njqbw96wx2qqhe6.oastify.com, a Burp Collaborator subdomain used for out-of-band callback collection. Despite its name suggesting a Tidal media embed player, the package contained no legitimate player functionality—only reconnaissance and exfiltration code.
The malicious package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- tidal-embed-player
- Domains
- 1rtlwocct2ruj1kc2njqbw96wx2qqhe6.oastify.com
Remediation
- Immediately uninstall tidal-embed-player from all systems where it was installed
- Audit npm install logs to identify when and where the package was installed
- Assume compromise of any system that installed this package; review for unauthorized access and data exfiltration
- Change credentials and SSH keys on affected systems
- Review DNS queries and outbound HTTPS connections from affected systems for signs of data exfiltration
- Use npm audit to check for other malicious packages in your dependency tree
- Consider using npm package signing verification and private package registries to prevent similar attacks
Sources
- GitHub Advisory GHSA-gfxj-v4hg-f5h7 · GitHub Advisory Database
Cite this entry
"Malicious code in tidal-embed-player (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-tidal-embed-player-npm-pilc8p
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
npmCompromised package