MalwarePublished 9 Jul 2026

fury_frontend-andes-ui (npm) · Malicious Code

Affects fury_frontend-andes-uiSource GCVE Database

Malicious package : remove fury_frontend-andes-ui and rotate any secrets on hosts that installed it.

Data as of 12 Jul 2026, 09:18 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10095

What to do

Remove fury_frontend-andes-ui from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmfury_frontend-andes-ui	Affected =99.9.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (29bea4f118854efa6568545722d7210a76e06e64cad4036e0cc0b45c45aafe37) The package's postinstall hook auto-executes index.js on `npm install`. The script collects the installer's OS username (os.userInfo()), current working directory (process.cwd()), and external IPv4 address from network interfaces, then POSTs them as JSON to a hardcoded interactsh out-of-band collector at dodwqvexnkotaavogofbj9kjz5pltcu7b.oast.fun/receive-data. The package name mimics MercadoLibre's internal 'fury/andes-ui' naming convention and is published at version 99.9.5 to force resolution over any legitimate internal package with the same name — the standard dependency-confusion attack shape. The package ships no library functionality matching its name; its only effect on install is the identity beacon.

Impact

Installation of this package results in unintended disclosure of environment-specific information such as the OS username, current working directory, and external IP address to an attacker-controlled server. This can aid attackers in reconnaissance and further targeted attacks. No direct code execution beyond the postinstall script is indicated, and no additional functionality is provided by the package.

Defensive guidance

Users should avoid installing the package fury_frontend-andes-ui@99.9.5 from untrusted sources. Verify package provenance and use scoped or internal registries to prevent dependency confusion attacks. Monitor dependency manifests for suspicious high-version packages mimicking internal names. Since this is a malicious package published to a public registry, removing or blocking this package from installation is recommended.

Summary

The malicious npm package fury_frontend-andes-ui@99.9.5 uses a postinstall hook to execute index.js automatically when installed. This script gathers sensitive environment information including the OS username, current working directory, and external IPv4 address, and exfiltrates this data via a POST request to a hardcoded out-of-band collector URL (dodwqvexnkotaavogofbj9kjz5pltcu7b.oast.fun/receive-data). The package name is crafted to impersonate MercadoLibre's internal 'fury/andes-ui' package, leveraging a dependency confusion attack by publishing a high version number (99.9.5) to override legitimate internal dependencies. The package contains no functional code beyond this data collection and exfiltration.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 10:00 UTC

Technical details

References

Community reviews