MalwarePublished 6 Aug 2026

dpdgroup-css (npm) · Malicious Code

Affects dpdgroup-cssSource GCVE Database

Malicious package : remove dpdgroup-css and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 06:12 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13444

What to do

Remove dpdgroup-css from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdpdgroup-css	Affected =2.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package dpdgroup-css version 2.0.1 contains malicious code that executes during installation. It runs a setup script that collects the installer's machine hostname and sends it to an external hardcoded IP address via an HTTP request. This behavior resembles a dependency confusion attack, where a public package mimics an internal package to exfiltrate internal build-host information. The package provides no legitimate functionality.

Impact

The malicious package leaks the hostname of the machine installing it to an external attacker-controlled server. This disclosure of internal build-host identifiers can aid attackers in reconnaissance and further targeted attacks. The package does not provide any legitimate functionality and runs code automatically during installation, which can lead to unintended data exposure.

Defensive guidance

Users should avoid installing dpdgroup-css version 2.0.1 from public npm registries. Verify internal package scopes and ensure dependency resolution does not pull public packages that impersonate internal ones. Monitor and audit package dependencies to prevent dependency confusion attacks.

Summary

The dpdgroup-css npm package version 2.0.1 declares preinstall and postinstall lifecycle hooks that execute a setup.js script on every npm install. This script reads the local machine's hostname using os.hostname() and sends it via an HTTP GET request to a hardcoded external IP address (http://89.116.25.133:4444/dpdgroup-css/<hostname>) with the hostname also included in an X-PoC-Host header. The package name suggests it is impersonating an internal DPDgroup package, consistent with a dependency confusion attack. No legitimate library functionality is present, indicating the package is malicious and designed to leak internal host identifiers to an external attacker-controlled endpoint.

References

npmjs.com/package/dpdgroup-css/v/2.0.1 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 06:12 UTC

Technical details

References

Community reviews