Malicious code in wos-library-ui (npm)
wos-library-ui@99.0.0 on npm contained malicious code that executed a preinstall script to exfiltrate system information (hostname, username, working directory) via DNS and HTTP to an attacker-controlled Interactsh subdomain. The package exploited dependency confusion by using an inflated version number to target internal Inditex packages.
- Disclosed
- Last updated
- Blast radius
- Any organization using npm with a private package named 'wos-library-ui' that resolves to the public registry; all npm users who installed the malicious version.
- Ecosystems
- Attack vectors
- Affected entities
- wos-library-ui · 99.0.0
wos-library-ui@99.0.0 published to npm contained a preinstall script (poc.js) that automatically executed during package installation. The script collected sensitive system metadata including the machine hostname, current user, and working directory, then transmitted this information to a hardcoded Interactsh subdomain (csytkgaubytabdgcvgljmgf8o1uj876pg.oast.fun) using both DNS A-record lookups and HTTP POST requests.
The attack leveraged dependency confusion: the package name and artificially inflated version number (99.0.0) were designed to be pulled from the public npm registry instead of an internal Inditex package named 'wos-library-ui'. Any npm resolver preferring the public registry would install the malicious version, triggering the exfiltration on install.
The package was self-labeled as a bug-bounty proof-of-concept, but this does not mitigate the unconsented install-time data exfiltration or the namesquatting of an internal package. The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- wos-library-ui@99.0.0
- Domains
- csytkgaubytabdgcvgljmgf8o1uj876pg.oast.fun
Remediation
- Remove wos-library-ui@99.0.0 from all environments immediately
- Audit npm install logs to identify systems that installed the malicious version
- Assume compromise of hostname, username, and build-path information for affected systems
- Review network logs for DNS queries and HTTP requests to csytkgaubytabdgcvgljmgf8o1uj876pg.oast.fun
- Implement npm registry authentication and private package scoping to prevent dependency confusion attacks
- Use npm audit and supply-chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-j5rq-m53m-6xfx · GitHub Advisory Database
Cite this entry
"Malicious code in wos-library-ui (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-wos-library-ui-npm-11bvar
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in alelo-services (npm)
alelo-services@99.0.0 on npm contained malicious preinstall and postinstall scripts that harvested and exfiltrated installer credentials, environment variables, and system metadata to a hardcoded IP endpoint. The package appears to be a dependency-confusion attack targeting a private scope.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in alelo-common (npm)
The npm package alelo-common contained malicious code that auto-executed during installation, exfiltrating system information, credentials, and environment variables to a remote IP address. The package name resembled a private scope, consistent with a dependency-confusion attack.
npmCompromised packageDependency confusion