test89078-auth (npm) · Malicious Code
Affects test89078-authSource GCVE Database
Malicious package : remove test89078-auth and rotate any secrets on hosts that installed it.
Data as of 18 Sep 2026, 01:12 UTC
Malicious package
Published to npm · OSV MAL-2026-16271
What to do
Remove test89078-auth from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmtest89078-auth | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c1ac938360c682e2489d11de9278697e7e2e85d73c612d2ab60ed28553bb5573) The package's preinstall script (scripts.preinstall = 'node index.js') runs automatically on npm install and collects os.userInfo().username and os.hostname(), then issues a dns.lookup against a subdomain of 31ee29fe-db68-4fd3-86a2-2b707b9e95f0.dnshook.site with the username and hostname embedded in the queried label. This is a DNS-based exfiltration beacon: installing the package transmits installer host identifiers to a non-first-party canary domain over DNS resolution at install time. The version number 99.99.99 and package name shape are consistent with a dependency-confusion lure targeting an internal package name.