Malicious code in @wbnr/frontend-shared (npm)
The npm package @wbnr/frontend-shared contained malicious code in a preinstall lifecycle script that exfiltrated installer system information (username, hostname) to a third-party callback domain via DNS and HTTPS, consistent with a dependency-confusion probe.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed @wbnr/frontend-shared during the malicious period
- Ecosystems
- Attack vectors
- Affected entities
- @wbnr/frontend-sharednpm package with malicious preinstall script
The npm package @wbnr/frontend-shared was found to contain malicious code embedded in a preinstall.js lifecycle script. This script automatically executes when the package is installed via npm install.
The malicious script collects sensitive system information from the installer's environment, including the OS username (from process.env USER/USERNAME) and hostname (via os.hostname()). This information is then embedded into a subdomain of a hardcoded callback host (4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com) and transmitted to the attacker via both DNS lookups and HTTPS GET requests to the /depconf/ path.
The behavior is consistent with a dependency-confusion attack probe using Burp Collaborator infrastructure (oastify.com). Each installation discloses installer identifiers—including username, internal hostname, timestamp, and package name—to the third-party callback domain, enabling reconnaissance of affected systems and networks.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @wbnr/frontend-shared
- Domains
- 4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com
Remediation
- Remove @wbnr/frontend-shared from all projects and dependencies
- Audit npm install logs to identify systems that installed the malicious package
- Review network logs for DNS queries and HTTPS connections to 4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com
- Consider the username and hostname information disclosed as potentially compromised; monitor for targeted attacks on affected systems
- Update npm packages to remove any dependency on @wbnr/frontend-shared
- Review npm audit and lock files to ensure no malicious versions remain
Sources
- GitHub Advisory GHSA-9vgv-g4jx-8g9w · GitHub Advisory Database
Cite this entry
"Malicious code in @wbnr/frontend-shared (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-wbnr-frontend-shared-npm-1y6kjv
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in alelo-services (npm)
alelo-services@99.0.0 on npm contained malicious preinstall and postinstall scripts that harvested and exfiltrated installer credentials, environment variables, and system metadata to a hardcoded IP endpoint. The package appears to be a dependency-confusion attack targeting a private scope.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in alelo-common (npm)
The npm package alelo-common contained malicious code that auto-executed during installation, exfiltrating system information, credentials, and environment variables to a remote IP address. The package name resembled a private scope, consistent with a dependency-confusion attack.
npmCompromised packageDependency confusion