The npm package @coopeuch/components version 1.999.999 contains malicious postinstall code that collects extensive installer environment and network metadata and exfiltrates it to a third-party server. This behavior occurs automatically during npm install and includes sensitive host, network, CI environment, and project dependency information. The package appears to be a dependency confusion attempt targeting internal @coopeuch scoped packages. No official patch or remediation guidance is provided.
The npm package @s4yhiitestpoc/scan-https-d version 1.0.0 contains malicious code that collects detailed installer host information during installation and sends it to a hardcoded external server. This includes hostname, username, home directory, current working directory, network interface addresses, DNS servers, and platform details. The package is labeled as a dependency-confusion proof-of-concept but exfiltrates sensitive environment data without user consent.
The npm package @coopeuch/common version 1.999.999 is a malicious package that uses a dependency confusion technique by publishing under a scope it does not own with an inflated version number. Upon installation, its postinstall script collects extensive host and network information from the installer's environment and exfiltrates this data to a third-party server without user consent. This includes internal hostnames, usernames, MAC addresses, internal registry URLs, and project metadata. The package README states this is a coordinated-disclosure proof of concept, but the data collection and exfiltration occur automatically and without opt-in.
The npm package @s4yhiitestpoc/r2-https version 1.0.0 contains malicious code in its postinstall script that collects detailed host environment data and sends it to a hardcoded external server without user consent. This includes sensitive information such as hostname, username, home directory, platform details, network interfaces, and npm configuration values that may reveal internal registry URLs. The script also performs an out-of-band DNS lookup to confirm execution, enabling covert data exfiltration during package installation.
The npm package @s4yhiitestpoc/r3-https version 1.0.0 contains malicious code that collects extensive host and environment information during installation. This includes host identity, network interfaces, DNS settings, and project metadata, which it sends to a hardcoded external server without user consent. This behavior is indicative of reconnaissance activity commonly associated with dependency confusion attacks.
The npm package react-paginate-v5@99.0.0 is a malicious package designed as a dependency confusion probe. It masquerades under a name similar to the legitimate react-paginate package but uses an implausibly high version number to override internal packages. Upon installation, it executes a preinstall script that performs a DNS lookup to an attacker-controlled domain, confirming the package's installation and revealing resolver metadata. The package has no legitimate functionality and can potentially execute arbitrary shell commands during installation.
The liferay-workspace-scripts npm package version 99.9.1 declares a dependency on a malicious package 'ltidisafe' hosted on a Google Cloud Storage URL. This dependency is fetched and installed without version pinning or integrity verification, allowing arbitrary code execution during npm install. The package name and version appear crafted to exploit dependency confusion, potentially executing attacker-controlled code on any machine installing this package.
The ksp-app npm package version 100.100.100 is a malicious dependency-confusion package that contains a prebuilt Linux x64 native addon. Upon installation, it executes a postinstall script that loads the native addon, which exfiltrates environment variables including HOSTNAME, npm_package_name, and npm_config_registry to a hardcoded IP address. The package exports no functional JavaScript code, indicating its sole purpose is to confirm installation in victim environments and disclose internal npm registry URLs to a third party.
The npm package ksp-client-registry versions 100.100.100 and 100.100.101 contain a malicious prebuilt native addon that, when loaded, collects environment information and sends it via a raw TCP socket to a hardcoded external IP address. This behavior occurs on package require and post-install, indicating a dependency confusion attack aimed at exfiltrating host and package details.
The npm package 'another-very-long-name' versions 1.0.1, 1.1.0, 2.0.0, and 2.0.1 contain malicious code that collects host system identifiers and sends them to a hardcoded external IP address via an unencrypted HTTP POST request. The package does not provide genuine functionality and appears to be designed for reconnaissance, likely related to dependency confusion attacks.
The npm package 'some-very-long-package-name' is a stub module that does not provide its advertised functionality. Instead, it contains malicious code that collects host and installation identifiers and sends them to a hardcoded IP address over plain HTTP. This beaconing occurs both at install time and when the module is loaded. The behavior is consistent with reconnaissance activity typical of dependency confusion or internal name squatting attacks.
The nested-lib npm package versions 1.0.0, 1.0.1, and 1.1.0 contain malicious code that sends system information to an unauthorized external server without user consent. The package executes a beacon script both during installation and when required, transmitting hostname, directory paths, and Node.js version over unencrypted HTTP to a hardcoded IP address. The package itself provides no real functionality, acting as a reconnaissance beacon likely used to confirm successful installation before further malicious activity.
The npm package pay-methods-kmf versions 100.100.100, 100.100.101, and 100.100.102 contains malicious code that exfiltrates sensitive information from the installer environment. Upon installation, it performs DNS beaconing and sends HTTP POST requests to an attacker-controlled server, leaking hostname, username, package name, and npm registry URL. The package includes a prebuilt native Linux addon with no source code, which performs these actions. This behavior is consistent with dependency confusion reconnaissance.
The npm package 'cloudflare_module' version 99.0.1 is a malicious dependency-confusion lure that exfiltrates host information without user consent. It executes a beacon script during installation and when required, sending system details to a hardcoded IP address over unencrypted HTTP. The package uses a Proxy to avoid errors during bundling, disguising its malicious behavior. It is not an official Cloudflare package and targets any system resolving its name.
The npm package @coopeuch/button version 1.999.999 contains malicious code in its postinstall script that collects extensive system and environment information from the installer host and sends it to a hardcoded external server. This package appears to be a dependency confusion attack targeting a specific organization's internal namespace by masquerading as an internal package. The malicious behavior includes harvesting host identifiers, network details, and environment variables, then exfiltrating this data over HTTPS and DNS queries to an unauthorized external destination.
The npm package deposit-limit-fe versions 100.100.101, 100.100.102, and 100.100.106 contains malicious code that exfiltrates sensitive environment information to an attacker-controlled server during installation. The package exports no real functionality but runs a native Linux x64 addon that sends the installer's hostname, OS username, package name, and npm registry URL to a hardcoded IP address. This behavior is indicative of a dependency-confusion reconnaissance attack targeting private npm registries. The malicious code executes automatically on installation, potentially compromising the installer's system privacy and security.
The nitro-cjs-requirer npm package contains malicious code that acts as a beacon to send host and environment information to a hardcoded IP address over plain HTTP. It executes this data transmission both during installation and when the module is required, without user consent or documentation. The module itself exports a proxy that returns no-op functions, making it appear benign while performing reconnaissance on the host system.
The @coopeuch/config npm package version 1.999.999 contains malicious code that executes automatically upon installation. It collects detailed host and environment information, including host identity, network interfaces, container detection, and project metadata, then sends this data to a hardcoded external server without user consent. This behavior exposes internal infrastructure details and private project identifiers to an unauthorized third party.
The npm package nitro-bundled-dep version 99.0.1 contains malicious code that executes during installation and module import. It collects system information such as hostname, installation path, current working directory, and Node.js version, then sends this data via an unencrypted HTTP POST to a hardcoded IP address unrelated to the package's stated purpose. This behavior resembles a dependency confusion attack, where an internal package name is resolved to a malicious public package with a high version number, enabling reconnaissance on the host system.
The sol-mint-utils RubyGem version 0.9.1 contains malicious code that executes during installation. It runs a base64-decoded Ruby payload in a forked process, which opens a reverse shell to a hardcoded IP address, allowing remote command execution. The payload includes anti-analysis checks to avoid detection in CI environments, sandboxes, or short uptime systems, and only activates if developer artifacts are present on the host.