dependencyfsdsfdsfg

GHSA-5928-vc2p-hrqj

Malicious code in dependencyfsdsfdsfg (npm)

Details

**Severity:** Critical

**Affected versions:** `= 99.9.0`

## Source: amazon-inspector (c53ad8755f0eb26cef8c05b49cdad8c69b93072e0d9ed176b071a7d367349cab)
package.json declares `postinstall: node index.js`, causing index.js to run automatically on `npm install`. The script collects the installer's username (via `whoami`), `os.hostname()`, `process.cwd()`, and non-internal IPv4 addresses from `os.networkInterfaces()`, then sends them as query-string parameters via HTTPS GET to the hardcoded endpoint `https://xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com`. The `*.oastify.com` host is a Burp Collaborator out-of-band interaction domain. Package metadata is consistent with a dependency-confusion probe: gibberish name `dependencyfsdsfdsfg`, version `99.9.0`, empty author/description/keywords.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/015eee03d13dd119c608c3fda8034ae6e540e772/osv/malicious/npm/dependencyfsdsfdsfg/MAL-2026-13754.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/015eee03d13dd119c608c3fda8034ae6e540e772/osv/malicious/npm/dependencyfsdsfdsfg/MAL-2026-13754.json
- https://www.npmjs.com/package/dependencyfsdsfdsfg/v/99.9.0
- https://github.com/advisories/GHSA-5928-vc2p-hrqj

Compromised versions (1)

= 99.9.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.