cs-core-api-phoenix

GHSA-5rmp-29vr-6q79

Malicious code in cs-core-api-phoenix (npm)

Details

**Severity:** Critical

**Affected versions:** `= 5.1.0`

cs-core-api-phoenix 5.1.0 is a dependency-confusion package: its postinstall script reads the OS user name and hostname and POSTs them to https://nathanaccacio.com/collect on every install. It targets an internal-looking name and collects data from whoever installs it, without consent.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/23ba843b4a773277fa7a4a51240e83cd70ea2a45/osv/malicious/npm/cs-core-api-phoenix/MAL-2026-18686.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/23ba843b4a773277fa7a4a51240e83cd70ea2a45/osv/malicious/npm/cs-core-api-phoenix/MAL-2026-18686.json
- https://www.npmjs.com/package/cs-core-api-phoenix
- https://github.com/advisories/GHSA-5rmp-29vr-6q79

Compromised versions (1)

= 5.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.