Malicious code in test-npm-snurkeburk-hackerone (npm)
The npm package test-npm-snurkeburk-hackerone version 1.999.0 contains malicious code in its preinstall lifecycle hook. This code collects host identifiers and the installer's public IP, encodes this information, and exfiltrates it via DNS queries to an author-controlled domain. This occurs during npm install before any consumer code runs, with no legitimate purpose for such behavior.
AI Analysis
Technical Summary
The package test-npm-snurkeburk-hackerone version 1.999.0 executes a preinstall script that gathers sensitive host information including hostname, current working directory, user identity, and public IP address. It hex-encodes this concatenated data and sends it out through DNS queries to subdomains of snurkeburk.com, effectively exfiltrating installer host identity data during installation. This behavior is malicious as it leaks potentially sensitive environment details without user consent or legitimate need.
Potential Impact
This vulnerability leads to the unauthorized disclosure of installer host identity information, including hostname, user, working directory, and public IP address, to an attacker-controlled domain. This can compromise user privacy and potentially aid further targeted attacks or reconnaissance. The exfiltration occurs silently during package installation, before any legitimate code executes.
Mitigation Recommendations
No patch or remediation information is provided. Users should avoid installing version 1.999.0 of test-npm-snurkeburk-hackerone. Verify package integrity and source before installation. Monitor for updates or advisories from the package maintainer or npm registry regarding remediation.
Malicious code in test-npm-snurkeburk-hackerone (npm)
Description
The npm package test-npm-snurkeburk-hackerone version 1.999.0 contains malicious code in its preinstall lifecycle hook. This code collects host identifiers and the installer's public IP, encodes this information, and exfiltrates it via DNS queries to an author-controlled domain. This occurs during npm install before any consumer code runs, with no legitimate purpose for such behavior.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The package test-npm-snurkeburk-hackerone version 1.999.0 executes a preinstall script that gathers sensitive host information including hostname, current working directory, user identity, and public IP address. It hex-encodes this concatenated data and sends it out through DNS queries to subdomains of snurkeburk.com, effectively exfiltrating installer host identity data during installation. This behavior is malicious as it leaks potentially sensitive environment details without user consent or legitimate need.
Potential Impact
This vulnerability leads to the unauthorized disclosure of installer host identity information, including hostname, user, working directory, and public IP address, to an attacker-controlled domain. This can compromise user privacy and potentially aid further targeted attacks or reconnaissance. The exfiltration occurs silently during package installation, before any legitimate code executes.
Mitigation Recommendations
No patch or remediation information is provided. Users should avoid installing version 1.999.0 of test-npm-snurkeburk-hackerone. Verify package integrity and source before installation. Monitor for updates or advisories from the package maintainer or npm registry regarding remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14141
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4cbacd9273b49252eac
Added to database: 08/19/2026, 13:51:07 UTC
Last enriched: 08/19/2026, 14:54:09 UTC
Last updated: 08/19/2026, 14:54:09 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.