MalwarePublished 8 Jul 2026Updated 20 Jul 2026

dependency_confusions (npm) · Malicious Code

Affects dependency_confusionsSource GCVE Database

Malicious package : remove dependency_confusions and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10085

What to do

Remove dependency_confusions from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdependency_confusions	Affected =99.9.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'dependency_confusions' version 99.9.9 contains malicious code that executes automatically upon installation via a postinstall hook. This code collects sensitive environment information including the installer's OS username, hostname, current working directory, local IPv4 address, and platform, then sends this data to a hardcoded external webhook. This behavior facilitates reconnaissance for dependency confusion attacks by revealing internal build host details and private package namespaces without user consent.

Impact

The malicious postinstall script leaks sensitive environment information from the victim's build environment, including usernames, hostnames, directory paths, and network addresses. This information disclosure can aid attackers in crafting targeted dependency confusion attacks against private package registries, potentially leading to further compromise of internal systems or supply chain attacks.

Defensive guidance

Users should avoid installing the affected version (=99.9.9) of the 'dependency_confusions' package. Review and audit package dependencies for unexpected lifecycle scripts, especially postinstall hooks that perform network communications. Consider using package integrity verification and restricting installation of untrusted packages to prevent similar malicious code execution.

Summary

The 'dependency_confusions' npm package version 99.9.9 includes a postinstall lifecycle hook that runs index.js on npm install. This script gathers environment details such as os.userInfo(), os.hostname(), current working directory, local IPv4 address, and platform, then exfiltrates this information as JSON to a hardcoded webhook.site URL. This automatic data exfiltration matches known patterns of dependency confusion reconnaissance, enabling attackers to identify internal infrastructure and private package namespaces to target subsequent attacks against private registries.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 10:07 UTC

Technical details

References

Community reviews