MalwarePublished 12 Jun 2026Updated 8 Jul 2026

ttspc-server-sample (npm) · Malicious Code

Affects ttspc-server-sampleSource GCVE Database

Malicious package : remove ttspc-server-sample and rotate any secrets on hosts that installed it.

Data as of 9 Jul 2026, 09:53 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5707

What to do

Remove ttspc-server-sample from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmttspc-server-sample	Affected 9.0.0 – 99.9.3 6 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'ttspc-server-sample' versions 9.0.0, 9.0.1, 99.9.0, 99.9.1, 99.9.2, and 99.9.3 contains malicious code that executes automatically upon installation. It collects sensitive system information including hostname, username, environment variables resembling credentials, network interface details, OS information, and running processes, then exfiltrates this data to an attacker-controlled domain. The package uses an inflated version number to override private internal packages, enabling a supply-chain attack. Systems with this package installed should be considered fully compromised, and all secrets should be rotated. Removal of the package alone may not fully remediate the compromise.

Impact

Installation of this package results in immediate exfiltration of sensitive host information and environment variables that may contain credentials. The attacker gains knowledge of internal IP addresses, running processes, and potentially secret keys. The system is considered fully compromised, and secrets stored on the host should be rotated. Removal of the package does not guarantee full remediation due to possible further malicious persistence.

Defensive guidance

The recommended mitigation is to immediately remove the package from any affected systems and consider those systems fully compromised. All secrets and keys stored on the compromised hosts should be rotated from a secure, unaffected environment. Vigilance against dependency confusion attacks is advised, including strict controls on package source resolution and verification of package provenance.

Summary

The 'ttspc-server-sample' npm package at specified versions declares a postinstall script that runs 'index.js' automatically during installation. This script collects extensive host information such as hostname, username, current directory, network IPs and MAC addresses, OS details, environment variables including those resembling credentials, and a full process list. It then sends this data via HTTP POST to a hardcoded attacker-controlled Burp Collaborator endpoint. The package uses a high version number (99.9.x) to supersede legitimate private packages in victim organizations, constituting a dependency confusion supply-chain attack. The package is identified as malicious by multiple sources including Amazon Inspector, GHSA malware database, and OpenSSF Package Analysis. There is no CVSS score or known exploits in the wild reported. The attack compromises the host fully, requiring secret rotation and comprehensive remediation.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 9 Jul 2026, 09:53 UTC

Technical details

References

Community reviews