MalwarePublished 3 May 2023Updated 8 Sep 2026

afterpay-sdk-example-server (npm) · Malicious Code

Affects afterpay-sdk-example-serverSource GCVE Database

What to do

Affected software

Product	Affected	Fixed in
npmafterpay-sdk-example-server	Affected =20.0.0 =1.2.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'afterpay-sdk-example-server' versions 20.0.0 and 1.2.1 contain malicious code that executes a preinstall script during npm install. This script collects sensitive host information including system identifiers, user info, DNS servers, and contents of critical files like /etc/passwd and /etc/hosts, then exfiltrates this data to an attacker-controlled domain. The package impersonates an internal Afterpay SDK example, consistent with a dependency confusion attack targeting internal build systems. Installation of this package can lead to full system compromise.

Impact

Systems that install this package leak sensitive host and user information to an attacker-controlled endpoint, potentially exposing system accounts, DNS configurations, and other critical data. The compromise is severe enough that all secrets and keys on the affected system should be rotated immediately from a different, trusted machine. The attacker may have full control over the compromised system, and simply removing the package does not guarantee removal of all malicious artifacts.

Defensive guidance

Users should immediately remove the 'afterpay-sdk-example-server' package versions 20.0.0 and 1.2.1 if installed. All secrets and credentials stored on the affected system must be rotated from a separate, secure environment. Due to the potential full compromise, consider rebuilding or thoroughly cleaning the affected system. Avoid installing packages from untrusted sources and verify package authenticity before installation.

Summary

The 'afterpay-sdk-example-server' npm package versions 20.0.0 and 1.2.1 include a preinstall hook that runs automatically during npm install. This hook executes a Node.js script that gathers extensive system and user information such as __dirname, os.homedir(), os.hostname(), os.userInfo(), DNS server details, and the full contents of /etc/passwd and /etc/hosts. It then sends this data via HTTPS POST to a malicious domain associated with Burp Collaborator OAST infrastructure. The package name is crafted to impersonate an internal Afterpay SDK example, indicating a dependency confusion attack vector. The OpenSSF Package Analysis and other sources classify this package as malicious. Any system installing this package is considered fully compromised, with a high risk of secret and key exposure.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Sep 2026, 05:23 UTC

Technical details

References

Community reviews