dc-renewals-layout2 (npm) · Malicious Code
Affects dc-renewals-layout2Source GCVE Database
Malicious package : remove dc-renewals-layout2 and rotate any secrets on hosts that installed it.
Data as of 5 Aug 2026, 16:51 UTC
Malicious package
Published to npm · OSV MAL-2026-12671
What to do
Remove dc-renewals-layout2 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmdc-renewals-layout2 | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package dc-renewals-layout2 version 9999.0.0 contains malicious code in its preinstall script that executes automatically during installation. This script sends a plaintext HTTP GET request to a hardcoded IP address on a non-standard port, transmitting sensitive environment information such as the installer's hostname, username, current working directory, npm registry, and CI repository slug. This behavior is identified as a dependency-confusion reconnaissance beacon, which can reveal private internal package names and enable targeted attacks against the installer's organization.