Malicious code in cat-sis2go-utils (npm)
Affects cat-sis2go-utilsSource GCVE Database
Rated by Threat Radar
Data as of 09/10/2026, 13:22:51 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmcat-sis2go-utils | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Avoid installing cat-sis2go-utils versions 99.0.0 and 99.1.0. Verify package authenticity before installation and audit dependencies for suspicious lifecycle scripts. Consider removing the package if already installed and monitor for unexpected network activity related to the described domains.
Description
cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code (index.js is an 87-byte stub), and package.json declares both preinstall and postinstall running `node scripts/run.js`, so the payload executes twice during npm install before any application code. The script resolves a DNS canary and POSTs to a webhook.site collector; 99.1.0 additionally sends os.userInfo().username and os.hostname(). The author labels this a PoC, but the beacon fires on any install that resolves the package and exfiltrates a username usable for follow-on attacks, and dependency-confusion packages require incident response even when trivial. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ad357542f3dd0e1b598ef36d440b1868ac28c6889226864bf799b2f7b6bf5e91) Package cat-sis2go-utils@99.0.0 declares both preinstall and postinstall lifecycle hooks in package.json that execute scripts/run.js on every npm install. The script unconditionally issues a DNS lookup against d22d92dc-84e5-4b58-8cd6-75bf1ac452c7.dnshook.site and POSTs a JSON beacon containing the installer's hostname and process context to https://webhook.site/d22d92dc-84e5-4b58-8cd6-75bf1ac452c7. The package description self-identifies as a dependency-confusion PoC, and the 99.0.0 version is consistent with a resolution-winning squat targeting an internal package name. Installing the package results in arbitrary code execution on the installer host and fingerprints the machine to third-party out-of-band collectors under the operator's control.
Impact
Installing the affected versions of cat-sis2go-utils leads to arbitrary code execution on the installer's machine. This enables the attacker to collect sensitive environment information such as hostname and process context, potentially facilitating further attacks or reconnaissance. The malicious behavior occurs silently during installation, posing a risk to any system where the package is installed.
Summary
The cat-sis2go-utils npm package versions 99.0.0 and 99.1.0 include both preinstall and postinstall lifecycle hooks that run scripts/run.js on every npm install. This script unconditionally performs a DNS lookup against a domain controlled by the attacker and sends a JSON payload containing the installer's hostname and process context to an external webhook URL. The package description indicates it is a dependency-confusion proof of concept, and the versioning suggests it is a squatted package intended to resolve in place of an internal package. Installing this package results in arbitrary code execution on the installer host and allows the attacker to fingerprint the machine remotely.