Malicious code in sm-session (npm)
The npm package 'sm-session' versions 99.0.0 and 99.0.1 contains malicious code that executes preinstall and postinstall scripts. These scripts send HTTP requests to a hardcoded IP address, signaling the installer's environment to an operator-controlled endpoint. This behavior is typical of dependency-confusion reconnaissance, where the package collects information about environments that resolve the package name. No legitimate functionality is provided by these network calls.
AI Analysis
Technical Summary
The 'sm-session' npm package versions 99.0.0 and 99.0.1 include preinstall and postinstall lifecycle scripts that execute curl commands to a hardcoded IPv4 address over plain HTTP. These scripts send data identifying the host environment (such as source IP, user-agent, and timing) to an attacker-controlled endpoint. This pattern matches dependency-confusion reconnaissance tactics, where malicious packages are used to detect environments resolving the package name. The package serves no legitimate purpose beyond this malicious signaling.
Potential Impact
Installation of the affected 'sm-session' package versions results in network calls to an attacker-controlled server, potentially exposing environment details such as IP address and user-agent. This can aid attackers in reconnaissance and targeting of affected systems. There is no indication of further payload delivery or exploitation beyond this information leakage.
Mitigation Recommendations
Users should avoid installing the 'sm-session' package versions 99.0.0 and 99.0.1. Remove these versions if already installed. Since no official patch or fix is indicated, rely on package reputation and source verification to prevent installation of malicious packages. Monitor package sources and prefer verified packages from trusted publishers.
Malicious code in sm-session (npm)
Description
The npm package 'sm-session' versions 99.0.0 and 99.0.1 contains malicious code that executes preinstall and postinstall scripts. These scripts send HTTP requests to a hardcoded IP address, signaling the installer's environment to an operator-controlled endpoint. This behavior is typical of dependency-confusion reconnaissance, where the package collects information about environments that resolve the package name. No legitimate functionality is provided by these network calls.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'sm-session' npm package versions 99.0.0 and 99.0.1 include preinstall and postinstall lifecycle scripts that execute curl commands to a hardcoded IPv4 address over plain HTTP. These scripts send data identifying the host environment (such as source IP, user-agent, and timing) to an attacker-controlled endpoint. This pattern matches dependency-confusion reconnaissance tactics, where malicious packages are used to detect environments resolving the package name. The package serves no legitimate purpose beyond this malicious signaling.
Potential Impact
Installation of the affected 'sm-session' package versions results in network calls to an attacker-controlled server, potentially exposing environment details such as IP address and user-agent. This can aid attackers in reconnaissance and targeting of affected systems. There is no indication of further payload delivery or exploitation beyond this information leakage.
Mitigation Recommendations
Users should avoid installing the 'sm-session' package versions 99.0.0 and 99.0.1. Remove these versions if already installed. Since no official patch or fix is indicated, rely on package reputation and source verification to prevent installation of malicious packages. Monitor package sources and prefer verified packages from trusted publishers.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14400
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a8c4c6facd9273b499c0cb8
Added to database: 08/24/2026, 13:51:43 UTC
Last enriched: 08/24/2026, 14:25:51 UTC
Last updated: 08/24/2026, 16:03:14 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.