Malicious code in @doaction/examples (npm)
The @doaction/examples npm package version 99.99.99 (and also 9.9.9) contains malicious code executed during installation via a preinstall hook. This hook runs a script that loads telemetry code from a sibling package, which collects environment variables and sends them to a remote destination without user consent or opt-out. The package is labeled 'for internal testing' but is publicly available, enabling dependency confusion attacks where organizations expecting internal @doaction packages may inadvertently install this malicious public package. The presence of inconsistent script naming further obscures the malicious behavior. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems must be rotated immediately. Removing the package alone may not fully remediate the compromise.
AI Analysis
Technical Summary
@doaction/examples versions 99.99.99 and 9.9.9 declare a preinstall hook in their package.json that executes a script loading telemetry code from @doaction/shared. This code collects environment variables and transmits them to a remote server without user consent or opt-out options. The package is described as 'for internal testing' but is publicly available on npm, making it a canonical example of a dependency confusion attack vector. Organizations with private @doaction scoped packages may inadvertently install this malicious package if their npm installs resolve to the public registry instead of an internal one. The inconsistent naming of preinstall scripts adds to the obfuscation of the malicious payload. According to the GHSA advisory, any system with this package installed should be treated as fully compromised, requiring immediate secret/key rotation and thorough remediation beyond just package removal.
Potential Impact
Installation of the affected @doaction/examples package versions results in execution of malicious code that collects environment variables and sends them to an external remote destination without user consent. This leads to a full compromise of the affected system, exposing secrets and keys stored on the computer. The compromise is severe enough that simply removing the package does not guarantee complete remediation, as the attacker may have established persistent control or installed additional malware.
Mitigation Recommendations
No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove the @doaction/examples package versions 99.99.99 and 9.9.9 from affected systems. All secrets, credentials, and keys stored on compromised machines should be rotated immediately from a separate, trusted system. Organizations should ensure their npm installs resolve to internal registries for private scoped packages to prevent dependency confusion attacks. Monitor for any signs of persistent compromise and perform thorough incident response as removal of the package alone may not fully eliminate the threat.
Malicious code in @doaction/examples (npm)
Description
The @doaction/examples npm package version 99.99.99 (and also 9.9.9) contains malicious code executed during installation via a preinstall hook. This hook runs a script that loads telemetry code from a sibling package, which collects environment variables and sends them to a remote destination without user consent or opt-out. The package is labeled 'for internal testing' but is publicly available, enabling dependency confusion attacks where organizations expecting internal @doaction packages may inadvertently install this malicious public package. The presence of inconsistent script naming further obscures the malicious behavior. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems must be rotated immediately. Removing the package alone may not fully remediate the compromise.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
@doaction/examples versions 99.99.99 and 9.9.9 declare a preinstall hook in their package.json that executes a script loading telemetry code from @doaction/shared. This code collects environment variables and transmits them to a remote server without user consent or opt-out options. The package is described as 'for internal testing' but is publicly available on npm, making it a canonical example of a dependency confusion attack vector. Organizations with private @doaction scoped packages may inadvertently install this malicious package if their npm installs resolve to the public registry instead of an internal one. The inconsistent naming of preinstall scripts adds to the obfuscation of the malicious payload. According to the GHSA advisory, any system with this package installed should be treated as fully compromised, requiring immediate secret/key rotation and thorough remediation beyond just package removal.
Potential Impact
Installation of the affected @doaction/examples package versions results in execution of malicious code that collects environment variables and sends them to an external remote destination without user consent. This leads to a full compromise of the affected system, exposing secrets and keys stored on the computer. The compromise is severe enough that simply removing the package does not guarantee complete remediation, as the attacker may have established persistent control or installed additional malware.
Mitigation Recommendations
No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove the @doaction/examples package versions 99.99.99 and 9.9.9 from affected systems. All secrets, credentials, and keys stored on compromised machines should be rotated immediately from a separate, trusted system. Organizations should ensure their npm installs resolve to internal registries for private scoped packages to prevent dependency confusion attacks. Monitor for any signs of persistent compromise and perform thorough incident response as removal of the package alone may not fully eliminate the threat.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5372
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-3hg6-5qgp-v676"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50ba7168715ace435800e1
Added to database: 07/10/2026, 09:25:05 UTC
Last enriched: 07/10/2026, 09:52:48 UTC
Last updated: 07/31/2026, 13:39:03 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.