MalwarePublished 6 Jul 2026Updated 14 Jul 2026

@flex-ng/header-component (npm) · Malicious Code

Affects @flex-ng/header-componentSource GCVE Database

Malicious package : remove @flex-ng/header-component and rotate any secrets on hosts that installed it.

Data as of 14 Jul 2026, 09:39 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10223

What to do

Remove @flex-ng/header-component from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@flex-ng/header-component	Affected =0.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @flex-ng/header-component npm package is a malicious package published as part of a dependency confusion campaign. It masquerades as a legitimate internal package but contains a preinstall script that collects and sends sensitive telemetry data, including public IP, hostname, OS username, and runtime environment details, to an attacker-controlled Sentry endpoint without user consent. The package also silently routes any error telemetry from consumers to the attacker. This behavior constitutes unauthorized data exfiltration and potential full system compromise.

Impact

Installing this package results in unauthorized exfiltration of sensitive telemetry data including the installer's public IP, hostname, OS username, and runtime environment metadata to an attacker-controlled Sentry endpoint. The package also enables ongoing data leakage by routing error telemetry from consumers to the attacker. According to the GHSA advisory, any system with this package installed should be considered fully compromised, requiring immediate secret and key rotation. The presence of this package may allow attackers to gain full control over the affected system.

Defensive guidance

The recommended mitigation is to immediately remove the package from all affected systems. Because the package may have granted attackers full control, all secrets and keys stored on the compromised systems should be rotated from a separate, trusted environment. Users should audit their dependency configurations to prevent dependency confusion attacks by ensuring private packages are resolved correctly and not overridden by public packages with similar names. Monitoring and blocking suspicious packages published under organizational scopes is advised.

Summary

This threat involves a malicious npm package named @flex-ng/header-component published by an attacker to exploit dependency confusion. The package's preinstall lifecycle script runs automatically during installation, installing @sentry/node and executing a script that collects the installer's public IP address and other personally identifiable information (PII) such as hostname, OS username, and runtime metadata. This data is sent to a hardcoded attacker-controlled Sentry project endpoint. Additionally, the package's code routes any error telemetry from consumers to the same attacker endpoint, enabling ongoing data leakage. The package name mimics an internal organizational scope to trick misconfigured resolvers into installing it instead of legitimate private packages. The malicious payload is consistent across all packages published by this attacker account, differing only in package name and target Sentry project ID. The threat is classified as a malicious package rather than a traditional vulnerability and indicates a high risk of system compromise and data leakage.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:39 UTC

Technical details

References

Community reviews