@cloudplatform-single-spa/smk

Details

**Severity:** Critical

**Affected versions:** `> 0`

Part of a dependency confusion attack campaign targeting the `@cloudplatform-single-spa` and `@mlspace` npm scopes. The attacker (npm user **mr.4nd3r50n**) published 139 scoped packages at the inflated version `99.99.99`, which resolves ahead of any private registry version via npm's default version resolution, silently hijacking installs of internal packages.

On installation, the `postinstall` hook executes `scripts/postinstall.js`. The script waits 3 seconds (sandbox evasion), then downloads an OS-specific second-stage JavaScript payload from `https://oob.moika.tech/payload/{mac|win|linux}.js`, writes it to a temporary file (`._cloudplatform-single-spa_init.js` in the system temp directory), and spawns it as a detached Node.js process that continues running after npm exits. The payload exfiltrates the full `process.env` (environment variables including secrets, tokens, and credentials), along with hostname, username, platform, architecture, and working directory, to the C2 endpoint `https://oob.moika.tech/report`. If the second-stage download fails, a fallback beacon containing the same system details is sent to the same endpoint.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/6911f74354c2db7446264ece95ffab0b47b56f4a/osv/malicious/npm/@cloudplatform-single-spa/smk/MAL-2026-4970.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/6911f74354c2db7446264ece95ffab0b47b56f4a/osv/malicious/npm/@cloudplatform-single-spa/smk/MAL-2026-4970.json
- https://safedep.io/oob-moika-tech-dependency-confusion-campaign
- https://github.com/advisories/GHSA-5gvw-r2qm-6jv3

Compromised versions (1)

• > 0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.