Threats Tagged 'mal-2026-10231'

The enbd-react-logger npm package version 4.0.0 is a malicious package published as part of a dependency confusion attack targeting organizations using an internal 'enbd' namespace. It contains a preinstall script that executes automatically during npm install, sending the host's public IP address, hostname, OS username, and runtime metadata to an attacker-controlled Sentry project without user consent. This behavior enables reconnaissance by the attacker to identify successful installs and affected organizations. The package also hardcodes the attacker's Sentry DSN, causing any downstream error reporting to leak data to the attacker. Removal of the package alone may not fully remediate the compromise, as the attacker may have gained broader control of the system.