Malicious code in chameleon-src (npm)
The npm package 'chameleon-src' version 6.6.29 executes a preinstall script that collects and uploads the installer's public IP address and hostname to a hardcoded Sentry project without user consent or disclosure. This telemetry collection occurs during every npm install via a forced exception capture that sends data including personally identifiable information (PII) to the attacker's Sentry endpoint. The package name and description do not reveal this behavior, making it a covert data exfiltration risk.
AI Analysis
Technical Summary
The 'chameleon-src' npm package (version 6.6.29) contains malicious code in its preinstall lifecycle script (examples/verify.js). This script runs automatically on installation and calls an init() function configured with sendDefaultPii:true and a hardcoded Sentry DSN. It fetches the installer's public IP from a Cloudflare endpoint and attaches it along with the hostname as user data to a forced exception event sent to the attacker's Sentry project. This results in unauthorized telemetry data exfiltration during package installation without user knowledge or opt-in.
Potential Impact
Every installation of the affected package version leaks the installer's public IP address and hostname to an attacker-controlled Sentry project. This unauthorized data collection violates user privacy and could aid in profiling or targeting the affected systems. There is no indication of further exploitation beyond telemetry exfiltration in the provided data.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing version 6.6.29 of 'chameleon-src'. Consider auditing dependencies for unexpected telemetry or network calls during installation. Monitor for updates or advisories from the package maintainer or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.
Malicious code in chameleon-src (npm)
Description
The npm package 'chameleon-src' version 6.6.29 executes a preinstall script that collects and uploads the installer's public IP address and hostname to a hardcoded Sentry project without user consent or disclosure. This telemetry collection occurs during every npm install via a forced exception capture that sends data including personally identifiable information (PII) to the attacker's Sentry endpoint. The package name and description do not reveal this behavior, making it a covert data exfiltration risk.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'chameleon-src' npm package (version 6.6.29) contains malicious code in its preinstall lifecycle script (examples/verify.js). This script runs automatically on installation and calls an init() function configured with sendDefaultPii:true and a hardcoded Sentry DSN. It fetches the installer's public IP from a Cloudflare endpoint and attaches it along with the hostname as user data to a forced exception event sent to the attacker's Sentry project. This results in unauthorized telemetry data exfiltration during package installation without user knowledge or opt-in.
Potential Impact
Every installation of the affected package version leaks the installer's public IP address and hostname to an attacker-controlled Sentry project. This unauthorized data collection violates user privacy and could aid in profiling or targeting the affected systems. There is no indication of further exploitation beyond telemetry exfiltration in the provided data.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing version 6.6.29 of 'chameleon-src'. Consider auditing dependencies for unexpected telemetry or network calls during installation. Monitor for updates or advisories from the package maintainer or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14202
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4c7acd9273b4925287e
Added to database: 08/19/2026, 13:51:03 UTC
Last enriched: 08/19/2026, 14:42:08 UTC
Last updated: 08/19/2026, 14:42:08 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.