cdf-tag-commander-helper (npm) · Malicious Code
Affects cdf-tag-commander-helperSource GCVE Database
Malicious package : remove cdf-tag-commander-helper and rotate any secrets on hosts that installed it.
Data as of 7 Aug 2026, 15:17 UTC
Malicious package
Published to npm · OSV MAL-2026-13481
What to do
Remove cdf-tag-commander-helper from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmcdf-tag-commander-helper | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (945179057c5bd93b985c3c532baa35379ce9dd9603e26d17e63201beb25868ae) The preinstall lifecycle script in cdf-tag-commander-helper@3.6.2 runs automatically on `npm install`. It executes `whoami` and `hostname`, retrieves the machine's public IP via ifconfig.me, and issues a plain-HTTP GET to a hardcoded Interactsh-style out-of-band callback subdomain (kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun), passing the three values as query parameters. The README states that the package makes no network requests, which contradicts the shipped code. The behavior is a reconnaissance beacon consistent with dependency-confusion targeting: on install, an attacker learns which internal build hosts and user accounts have resolved this package name.