MalwarePublished 9 Jun 2026Updated 1 Sep 2026

housecall-ui (npm) · Malicious Code

Affects housecall-uiSource GCVE Database

Malicious package : remove housecall-ui and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 18:47 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5446

What to do

Remove housecall-ui from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmhousecall-ui	Affected =99.9.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package housecall-ui@99.9.1 is a hollow package that acts as a dependency confusion lure. It contains no functionality itself but declares a runtime dependency on a tarball hosted on a third-party Google Cloud Storage bucket controlled by an attacker. Installing this package causes npm to fetch and execute untrusted code from mutable infrastructure outside the npm registry, leading to full system compromise. The package name mimics a legitimate internal package to increase the chance of accidental installation. Any system with this package installed should be considered fully compromised, and all secrets on it must be rotated immediately.

Impact

Installing housecall-ui@99.9.1 results in execution of attacker-controlled code on the victim system, leading to full compromise. Attackers may gain complete control, access all stored secrets and keys, and persist malicious software. Removal of the package alone does not guarantee eradication of the compromise. Immediate secret rotation from a separate, uncompromised system is required.

Defensive guidance

Remove the housecall-ui@99.9.1 package immediately. Consider any system with this package installed fully compromised and rotate all secrets and keys from a different, secure computer. Due to the nature of the compromise, further forensic analysis and remediation may be necessary. Avoid installing packages from untrusted or suspicious sources, especially those with unusual versioning or external dependencies hosted outside official registries. Monitor for similar dependency confusion attempts in your environment.

Summary

housecall-ui@99.9.1 is an empty npm package whose sole runtime dependency is an HTTPS tarball URL pointing to a third-party Google Cloud Storage bucket. This bucket is not part of the npm registry, is mutable, and not pinned by hash, allowing the attacker to control the code executed during npm install lifecycle scripts. The package name and version are crafted to out-rank internal packages in mixed-resolution environments, a classic dependency confusion attack. The package itself exports an empty object and contributes no functionality other than sideloading malicious code from attacker-controlled infrastructure.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 18:47 UTC

Technical details

References

Community reviews