Malicious code in sm-cart (npm)
The npm package 'sm-cart' versions 99.0.0 and 99.0.1 contain malicious preinstall and postinstall scripts that unconditionally execute curl commands to a hardcoded IP address. This behavior causes the installing host to send information such as the internal package name, the host's public IP, and installation success to an external operator. The package itself has no functional code and uses a high version number to override internal packages with the same name, facilitating dependency confusion attacks.
AI Analysis
Technical Summary
The 'sm-cart' npm package at versions 99.0.0 and 99.0.1 includes preinstall and postinstall scripts that run curl commands to http://16.192.173.5/sm-cart/pre and http://16.192.173.5/sm-cart/post respectively. These scripts execute unconditionally on installation, causing the host to beacon over plain HTTP to a hardcoded IP address. The package contains no functional code and is designed to win private-name resolution by using an implausibly high version number, enabling it to be installed instead of an internal package with the same name. This results in leakage of internal package names, the host's public IP address, and installation success information to the external operator, constituting malicious behavior.
Potential Impact
Installation of the affected 'sm-cart' package versions results in unintended network communication to an external IP address, potentially disclosing sensitive information such as internal package names and the public IP address of the host. This can lead to information leakage and reconnaissance by an attacker. The package does not provide any legitimate functionality and is designed to exploit dependency confusion to be installed in place of internal packages.
Mitigation Recommendations
Avoid installing the 'sm-cart' package versions 99.0.0 and 99.0.1 from public npm repositories. Verify and enforce strict package source controls to prevent dependency confusion attacks, such as using scoped packages or private registries. Remove any instances of these versions from build systems and lockfiles. Monitor for and block network traffic to the IP address 16.192.173.5 if possible. Patch status is not confirmed; check vendor or repository advisories for updates or removals.
Malicious code in sm-cart (npm)
Description
The npm package 'sm-cart' versions 99.0.0 and 99.0.1 contain malicious preinstall and postinstall scripts that unconditionally execute curl commands to a hardcoded IP address. This behavior causes the installing host to send information such as the internal package name, the host's public IP, and installation success to an external operator. The package itself has no functional code and uses a high version number to override internal packages with the same name, facilitating dependency confusion attacks.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'sm-cart' npm package at versions 99.0.0 and 99.0.1 includes preinstall and postinstall scripts that run curl commands to http://16.192.173.5/sm-cart/pre and http://16.192.173.5/sm-cart/post respectively. These scripts execute unconditionally on installation, causing the host to beacon over plain HTTP to a hardcoded IP address. The package contains no functional code and is designed to win private-name resolution by using an implausibly high version number, enabling it to be installed instead of an internal package with the same name. This results in leakage of internal package names, the host's public IP address, and installation success information to the external operator, constituting malicious behavior.
Potential Impact
Installation of the affected 'sm-cart' package versions results in unintended network communication to an external IP address, potentially disclosing sensitive information such as internal package names and the public IP address of the host. This can lead to information leakage and reconnaissance by an attacker. The package does not provide any legitimate functionality and is designed to exploit dependency confusion to be installed in place of internal packages.
Mitigation Recommendations
Avoid installing the 'sm-cart' package versions 99.0.0 and 99.0.1 from public npm repositories. Verify and enforce strict package source controls to prevent dependency confusion attacks, such as using scoped packages or private registries. Remove any instances of these versions from build systems and lockfiles. Monitor for and block network traffic to the IP address 16.192.173.5 if possible. Patch status is not confirmed; check vendor or repository advisories for updates or removals.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14396
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a8c4c74acd9273b499c0e09
Added to database: 08/24/2026, 13:51:48 UTC
Last enriched: 08/24/2026, 14:26:25 UTC
Last updated: 08/25/2026, 00:58:04 UTC
Views: 23
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.