Malicious code in foodi (npm)
The npm package 'foodi' version 99.99.1 contains malicious preinstall and postinstall scripts that execute commands to collect the username, hostname, and environment variables, then exfiltrate this data via an insecure POST request to an external server. The package's main module is empty, indicating its primary purpose is to perform install-time data exfiltration, potentially leaking sensitive credentials and tokens from developer or CI environments.
AI Analysis
Technical Summary
The 'foodi' npm package version 99.99.1 includes lifecycle scripts that run during installation, executing 'whoami', 'hostname', and dumping environment variables. These collected data points are sent via a POST request to a subdomain of oastify.com with TLS certificate verification disabled, allowing exfiltration of potentially sensitive information such as credentials and API keys. The main module of the package is empty, consistent with a dependency confusion or squatting attack designed solely for install-time data theft.
Potential Impact
Installation of the affected 'foodi' package version results in the exposure of sensitive environment information, including usernames, hostnames, and environment variables that may contain credentials, API keys, and CI tokens. This data is transmitted to an attacker-controlled server, potentially compromising developer and continuous integration environments.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing the 'foodi' package version 99.99.1. Review and audit dependencies carefully to prevent supply chain attacks involving malicious packages. Monitor for updates from the package maintainer or npm security advisories for any official fixes or removals.
Malicious code in foodi (npm)
Description
The npm package 'foodi' version 99.99.1 contains malicious preinstall and postinstall scripts that execute commands to collect the username, hostname, and environment variables, then exfiltrate this data via an insecure POST request to an external server. The package's main module is empty, indicating its primary purpose is to perform install-time data exfiltration, potentially leaking sensitive credentials and tokens from developer or CI environments.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'foodi' npm package version 99.99.1 includes lifecycle scripts that run during installation, executing 'whoami', 'hostname', and dumping environment variables. These collected data points are sent via a POST request to a subdomain of oastify.com with TLS certificate verification disabled, allowing exfiltration of potentially sensitive information such as credentials and API keys. The main module of the package is empty, consistent with a dependency confusion or squatting attack designed solely for install-time data theft.
Potential Impact
Installation of the affected 'foodi' package version results in the exposure of sensitive environment information, including usernames, hostnames, and environment variables that may contain credentials, API keys, and CI tokens. This data is transmitted to an attacker-controlled server, potentially compromising developer and continuous integration environments.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing the 'foodi' package version 99.99.1. Review and audit dependencies carefully to prevent supply chain attacks involving malicious packages. Monitor for updates from the package maintainer or npm security advisories for any official fixes or removals.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12383
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a73574fbf8831d53915a57f
Added to database: 08/05/2026, 15:31:27 UTC
Last enriched: 08/05/2026, 17:46:00 UTC
Last updated: 09/15/2026, 12:32:51 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.