MalwarePublished 9 Jul 2026

dl-pp-latm (npm) · Malicious Code

Affects dl-pp-latmSource GCVE Database

Malicious package : remove dl-pp-latm and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 10:06 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10086

What to do

Remove dl-pp-latm from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdl-pp-latm	Affected =80.4.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package dl-pp-latm version 80.4.2 contains malicious code that executes automatically during installation. It runs preinstall and postinstall scripts that collect sensitive machine information such as hostnames, usernames, home directories, DNS servers, current working directory, and the full package.json file. This data is then transmitted to a third-party external server via HTTPS POST and DNS lookup. The package appears to be part of a dependency-confusion attack targeting internal or private package names, causing leakage of internal hostnames, usernames, and DNS configurations from developer workstations or CI systems without user interaction.

Impact

Sensitive internal information including hostnames, usernames, home directories, DNS server configurations, and full package metadata can be exfiltrated to an external attacker-controlled domain. This leakage can expose internal network details and user environment data, potentially aiding further targeted attacks or reconnaissance. The compromise occurs automatically during package installation without user consent or awareness.

Defensive guidance

Users should avoid installing dl-pp-latm@80.4.2 and audit dependencies for suspicious or unexpected packages, especially those matching internal or private naming patterns. Implement strict package source verification and consider using package allowlists or internal registries to prevent dependency confusion attacks. Monitor for and remove this package if found in existing environments.

Summary

The npm package dl-pp-latm@80.4.2 registers preinstall and postinstall lifecycle hooks that execute index.js, which collects various machine identifiers (os.hostname(), os.userInfo().username, os.homedir(), dns.getServers(), current working directory, and full package.json) and exfiltrates them to an external Interactsh-style domain 'bvfmpadujgjgmbtzeibiikzijuhmtd2rs.oast.fun' via HTTPS POST and DNS lookup. The package name pattern and description indicate it is a dependency-confusion probe targeting internal/private package names. This results in automatic leakage of sensitive internal environment information on npm install without user interaction.

References

npmjs.com/package/dl-pp-latm/v/80.4.2 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 10:06 UTC

Technical details

References

Community reviews