MalwarePublished 5 Aug 2026

sc-payment-utils (npm) · Malicious Code

Affects sc-payment-utilsSource GCVE Database

Malicious package : remove sc-payment-utils and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 16:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12801

What to do

Remove sc-payment-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsc-payment-utils	Affected =9999.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package sc-payment-utils version 9999.0.0 contains a malicious preinstall script that executes callback.js during installation. This script collects sensitive host information including hostname, username, current directory, npm registry, and various CI environment variables. It then sends this data via an HTTP GET request to a hardcoded IP address, indicating reconnaissance activity consistent with dependency confusion attacks targeting internal package names leaked to public registries.

Impact

The malicious script leaks sensitive environment and host information to an external attacker-controlled server. This reconnaissance data could be used to facilitate further attacks such as dependency confusion or supply chain compromise. There is no indication of direct code execution or data destruction beyond information disclosure. No known exploits in the wild have been reported.

Defensive guidance

Users should avoid installing sc-payment-utils version 9999.0.0. Since this is a malicious package version, the best mitigation is to remove or block this package from use. Monitor package sources and dependency trees for suspicious or unexpected versions.

Summary

The sc-payment-utils package at version 9999.0.0 includes a preinstall script that runs callback.js when the package is installed via npm. This script gathers host identity details such as os.hostname(), os.userInfo().username, the current working directory, the configured npm registry, and multiple continuous integration repository slug environment variables (e.g., GITHUB_REPOSITORY, CI_PROJECT_PATH). It then issues an HTTP GET request to a fixed IP endpoint (http://75.119.137.232:31337/depconfuse) with these details as query parameters. The version number and the nature of the callback suggest this is a dependency confusion reconnaissance payload designed to collect information about internal package usage leaked into public package resolution.

References

npmjs.com/package/sc-payment-utils/v/9999.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 16:56 UTC

Technical details

References

Community reviews