MalwarePublished 26 Oct 2026Updated 13 Nov 2026

cs-core-api-phoenix (npm) · Malicious Code

Affects cs-core-api-phoenixSource GCVE Database

Malicious package : remove cs-core-api-phoenix and rotate any secrets on hosts that installed it.

Data as of 13 Nov 2026, 04:29 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18686

What to do

Remove cs-core-api-phoenix from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcs-core-api-phoenix	Affected =5.1.0 =116.0.1 =150.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package cs-core-api-phoenix version 5.1.0 contains malicious code that executes during installation. Its postinstall script collects the operating system's username and hostname and sends this information to a third-party URL without user consent. This behavior occurs automatically on installation and exposes user identity data to an external actor.

Impact

Installation of the affected package results in disclosure of the installer's OS username and hostname to an unauthorized third party. This data leakage can aid attackers in reconnaissance and profiling of internal environments or users. The compromise occurs silently during installation, potentially affecting any user or system that installs the package version 5.1.0 or the other specified versions.

Defensive guidance

Avoid installing the affected versions of cs-core-api-phoenix. Remove any installations of these versions and replace them with trusted, verified packages. Monitor for any unauthorized data transmissions from development or build environments.

Summary

The cs-core-api-phoenix package version 5.1.0 is a dependency-confusion malicious package. During the npm install process, its postinstall script runs node index.js, which reads the OS username and hostname via os.userInfo().username and os.hostname(). It then sends this data along with a package identifier to the hardcoded external endpoint https://nathanaccacio.com/collect using an HTTPS POST request. The package name mimics a legitimate core API client but includes no legitimate functionality requiring this data collection. This automatic data exfiltration provides reconnaissance information to the operator of the external endpoint without the installer's knowledge or consent.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Nov 2026, 04:29 UTC

Technical details

References

Community reviews