MalwarePublished 6 Aug 2026

@cats-cdf/browser-metrics-meter (npm) · Malicious Code

Affects @cats-cdf/browser-metrics-meterSource GCVE Database

Malicious package : remove @cats-cdf/browser-metrics-meter and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13479

What to do

Remove @cats-cdf/browser-metrics-meter from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@cats-cdf/browser-metrics-meter	Affected =3.1.1 =2.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (83df5c7e17dd2b9a808bddee17deb157e88a12632a632177f7969fce9ccfa7a8) The package's preinstall lifecycle script runs automatically on `npm install` and executes `whoami` and `hostname`, then fetches the machine's public IP from ifconfig.me and transmits all three values as query-string parameters to a hardcoded out-of-band interaction domain (kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun) over plain HTTP via curl, with a wget fallback. The domain is an OAST (out-of-band application security testing) collector used to receive exfiltrated reconnaissance data. The behavior fires unconditionally with no first-party relationship, no consent, and no documented purpose consistent with the package name.

Impact

The malicious preinstall script leaks sensitive system information including the username, hostname, and public IP address to an external attacker-controlled domain. This can lead to privacy violations and may facilitate further targeted attacks by revealing environment details. The data is transmitted in cleartext, increasing the risk of interception. There is no indication of further payload delivery or exploitation beyond this reconnaissance activity.

Defensive guidance

Users should avoid installing versions 3.1.1 and 2.0.0 of @cats-cdf/browser-metrics-meter. Consider removing these versions from any dependency trees and replacing them with trusted alternatives. Monitor for updates from the package maintainer or npm advisories for any future fixes. Since this is a malicious package behavior, reporting it to npm for takedown is recommended.

Summary

The @cats-cdf/browser-metrics-meter npm package versions 3.1.1 and 2.0.0 include a preinstall script that executes commands to obtain the username (whoami), hostname, and public IP address (via ifconfig.me). These values are transmitted as query parameters over plain HTTP to a hardcoded external domain (kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun) using curl or wget. This domain is an out-of-band application security testing (OAST) collector, indicating the package performs unauthorized reconnaissance and data exfiltration during installation without any documented or legitimate purpose.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 09:01 UTC

Technical details

References

Community reviews