jshelperdependenceny

GHSA-249c-6w49-6274

Malicious code in jshelperdependenceny (npm)

Details

**Severity:** Critical

**Affected versions:** `= 99.0.0`

## Source: amazon-inspector (dc4d19697f4104351bb25b7e568018ec6ed85d626b7265fb4b9682ae12183be9)
npm package 'jshelperdependenceny' is published at version 99.0.0 with a preinstall banner stating it is intended to shadow an internal v1.0.0 package of the same name — the classic dependency-confusion shape of using an inflated version to win resolution against a private registry. On install, package.json runs 'node preinstall.js || true', which collects os.hostname(), os.platform(), os.arch(), and the package name/version and POSTs them as JSON to a URL taken from the DC_CALLBACK_URL environment variable, defaulting to http://127.0.0.1:5656/exfil. The env-var override turns the loopback default into a functional attacker-configurable beacon that fires automatically on npm install and discloses installer host identifiers plus confirmation that the shadowed internal name resolved to this public artifact.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b711d7c76f98b5044512e8c851547e8a05b2f959/osv/malicious/npm/jshelperdependenceny/MAL-2026-18288.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/b711d7c76f98b5044512e8c851547e8a05b2f959/osv/malicious/npm/jshelperdependenceny/MAL-2026-18288.json
- https://www.npmjs.com/package/jshelperdependenceny/v/99.0.0
- https://github.com/advisories/GHSA-249c-6w49-6274

Compromised versions (1)

= 99.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.