MalwarePublished 15 Jun 2026Updated 14 Aug 2026

lab-helper (npm) · Malicious Code

Affects lab-helperSource GCVE Database

Malicious package : remove lab-helper and rotate any secrets on hosts that installed it.

Data as of 14 Aug 2026, 16:50 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5835

What to do

Remove lab-helper from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmlab-helper	Affected =0.0.3 =0.0.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'lab-helper' versions 0.0.2 and 0.0.3 contains malicious code that executes during installation. The postinstall script runs a JavaScript file that checks if the host's IPv4 address starts with 18.175., targeting a specific subnet. If the condition is met, it reads a file named 'myfile.txt' from the installer's working directory and exfiltrates its contents to a hardcoded command and control server at http://18.175.63.47:8080/collect. This behavior indicates a targeted supply-chain attack likely aimed at specific AWS or lab environments. Any system with this package installed should be considered fully compromised, and all secrets and keys must be rotated immediately. Removal of the package does not guarantee full remediation due to potential persistence of malicious software.

Impact

Systems that install the affected versions of the 'lab-helper' package and meet the network targeting criteria are at high risk of data exfiltration. The malicious script can leak sensitive files from the installer's environment to an external attacker-controlled server. The compromise is severe enough that the entire system should be considered fully compromised, necessitating immediate rotation of all secrets and keys. Removal of the package alone may not eliminate all malicious components, indicating potential persistence mechanisms.

Defensive guidance

Immediate removal of the 'lab-helper' package versions 0.0.2 and 0.0.3 is recommended. Due to the high likelihood of full system compromise, all secrets and credentials stored on the affected system should be rotated from a separate, trusted environment. Investigate the system for additional malicious artifacts or persistence mechanisms. Monitor for any network traffic to the IP address 18.175.63.47 and block it if possible.

Summary

The 'lab-helper' npm package versions 0.0.2 and 0.0.3 include a postinstall lifecycle script that runs 'sec_check.js'. This script enumerates network interfaces and proceeds only if an IPv4 address matches the 18.175. subnet, effectively gating execution to targeted environments. Upon passing this gate, the script reads 'myfile.txt' from the installer's current working directory and sends its contents via an HTTP POST request to a hardcoded IP address (18.175.63.47) on port 8080. This exfiltration mechanism, combined with the targeted network check and automatic execution during package installation, characterizes a supply-chain attack designed to stealthily compromise specific hosts, likely within AWS or lab subnets.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 16:50 UTC

Technical details

References

Community reviews