Skip to main content

Malicious code in github-app-sts-action (npm)

0
High
Published: 08/05/2026 (08/05/2026, 12:48:10 UTC)
Source: GCVE Database
Product: github-app-sts-action

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9434f2e4ac17da4d2b9dff0c36ed8b3c5cc3f76882b9898b768e78ba982bbac2) The package declares a preinstall lifecycle hook that runs index.js on `npm install`. index.js collects host identifiers and system files (os.hostname(), os.userInfo(), home directory, DNS servers, /etc/passwd, /etc/hosts, and package.json contents) and POSTs them via HTTPS to the hardcoded subdomain lncqub6t1loht8b887c8hvcjva13ptdi.oastify.com — a Burp Collaborator out-of-band interaction host used for reconnaissance. There is no advertised functional purpose in the package that would justify this data collection; the code path exists solely to transmit installer host and credential-adjacent file contents to an attacker-controlled endpoint. ## Source: ghsa-malware (87310aa13634f4a26c92164452e9ff0c95d3ee5924feb2f6b5c48354d32ee482) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Affected software

npmghsa
github-app-sts-action
Affected versions
=1.0.1

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 08/05/2026, 17:26:09 UTC

Technical Analysis

The github-app-sts-action npm package version 1.0.1 declares a preinstall lifecycle hook that runs index.js during npm install. This script collects various host identifiers and sensitive system files such as os.hostname(), os.userInfo(), home directory contents, DNS server settings, /etc/passwd, /etc/hosts, and package.json contents. It then transmits this information via HTTPS POST to a hardcoded subdomain (lncqub6t1loht8b887c8hvcjva13ptdi.oastify.com), which is a Burp Collaborator out-of-band interaction host used for reconnaissance. The package does not advertise any legitimate functionality that would require this data collection, indicating the code is malicious and intended to exfiltrate sensitive host data during installation.

Potential Impact

Sensitive host and system information, including user and network configuration details, is exfiltrated to an attacker-controlled endpoint during package installation. This can lead to reconnaissance that facilitates further attacks or compromise of the affected system. No direct code execution beyond the preinstall script is described, but the data leakage itself poses a significant privacy and security risk.

Mitigation Recommendations

No official patch or remediation is currently documented. Users should avoid installing version 1.0.1 of github-app-sts-action. Review and audit dependencies before installation, and remove any instances of this package from environments. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Osv Id
MAL-2026-12389
Osv Schema Version
1.7.4
Ecosystems
["npm"]

Threat ID: 6a735745bf8831d539159f53

Added to database: 08/05/2026, 15:31:17 UTC

Last enriched: 08/05/2026, 17:26:09 UTC

Last updated: 09/08/2026, 04:37:17 UTC

Views: 19

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses