MalwarePublished 5 Aug 2026

break-after (npm) · Malicious Code

Affects break-afterSource GCVE Database

Malicious package : remove break-after and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 16:57 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12518

What to do

Remove break-after from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbreak-after	Affected =9999.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The break-after npm package version 9999.0.0 contains malicious code in its preinstall script that executes automatically during npm install. This script collects sensitive environment information including hostname, username, current working directory, npm registry configuration, and CI/repository environment variables. It then exfiltrates this data via an HTTP GET request to a hardcoded IP address. This behavior is consistent with a dependency confusion reconnaissance payload designed to identify victim organizations and their private repository names.

Impact

Sensitive environment and organizational information including hostnames, usernames, working directories, npm registry configurations, and internal CI/repository identifiers are exfiltrated to an attacker-controlled server. This can lead to exposure of private repository names and internal infrastructure details, potentially facilitating further targeted attacks or reconnaissance against the victim organization.

Defensive guidance

Users should avoid installing the break-after package version 9999.0.0 from public npm registries. Implement strict dependency version pinning and verify package authenticity before installation. Monitor for and block network connections to the hardcoded IP address (75.119.137.232) to prevent data exfiltration. Check vendor advisories or trusted security sources for updates or official remediation guidance.

Summary

The break-after package at version 9999.0.0 includes a malicious preinstall script that runs automatically on installation. The script gathers system and environment details such as os.hostname(), os.userInfo().username, process.cwd(), the npm registry URL, and CI/repository environment variables. It sends these details as query parameters in an HTTP GET request to a hardcoded IP endpoint (http://75.119.137.232:31337/depconfuse). The use of a high version number combined with exfiltration of internal repository identifiers indicates this is a dependency confusion reconnaissance payload intended to be resolved by internal builds, thereby leaking sensitive organizational information.

References

npmjs.com/package/break-after/v/9999.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 16:57 UTC

Technical details

References

Community reviews