@heartlandone-private/fontawesome-pro (npm) · Malicious Code
Affects @heartlandone-private/fontawesome-proSource GCVE Database
Malicious package : remove @heartlandone-private/fontawesome-pro and rotate any secrets on hosts that installed it.
Data as of 8 Aug 2026, 14:53 UTC
Malicious package
Published to npm · OSV MAL-2026-11093
What to do
Remove @heartlandone-private/fontawesome-pro from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@heartlandone-private/fontawesome-pro | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5dc8f9f53c05ecc2642ce82c3841e046025662c206f002b4c6da11ff0cbc763d) The package's postinstall lifecycle hook runs `node index.js`, which issues an HTTPS GET to a hardcoded Burp Collaborator subdomain at `e0fumpwx24ddfmenzmg0izs2atgk4es3.oastify.com/dependency-confusion` with a User-Agent identifying it as a dependency-confusion probe. On any `npm install` that resolves this scoped name, the request fires automatically and discloses installer identity (source IP, DNS resolver, timing, request metadata) to a third-party out-of-band interaction server controlled by whoever provisioned the Collaborator instance. The package name uses a private-scope pattern (`@heartlandone-private/fontawesome-pro`) that mimics an internal artifact, consistent with a dependency-confusion attempt aimed at organizations whose internal `@heartlandone-private` scope is not reserved on the public registry. Whether the operator's intent is authorized red-team testing or opportunistic exploitation, any consumer whose install pipeline resolves this public package receives install-time code execution and outbound network signalling to an attacker-controlled callback. ## Source: ossf-package-analysis (b5bd52805195c9e3575760b3eaf605a2b9cb0fcbdde2311b7075d2d8095c4900) The OpenSSF Package Analysis project identified '@heartlandone-private/fontawesome-pro' @ 6.3.3 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.