@selfpentest/bin-confusion

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (40a68543ca2674f2b90d89dd52516736791b7886d617c694d89dd3135e7499f3)
package.json registers a `bin` entry named `npm` pointing at npm.js, deliberately colliding with the core npm CLI. Once this package is installed as a dependency, any `npm...` invocation in a consuming project's scripts resolves via node_modules/.bin to this shim, executing the shipped code before (or instead of) the real npm. npm.js contains a `steal()` routine that reads process.env.HOME, process.env.SECRET, and the first 30 bytes of ~/.ssh/known_hosts, concatenates them into a query string, and issues a fetch GET to http://localhost:1337/. The destination is loopback in this build, but the collected data (installer SSH known_hosts contents and environment secrets) is packaged into a functioning exfiltration primitive that fires whenever the shadow `npm` shim is invoked from the installer's build scripts. The scope name (`@selfpentest`) and README frame this as a demonstration, but the shipped tarball is a working bin-shadow + credential-read + network-send chain against installers who add it as a dependency.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/df8912ac853d808526d73c577abd0cdfa8d704f1/osv/malicious/npm/@selfpentest/bin-confusion/MAL-2026-17292.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/df8912ac853d808526d73c577abd0cdfa8d704f1/osv/malicious/npm/@selfpentest/bin-confusion/MAL-2026-17292.json
- https://www.npmjs.com/package/@selfpentest/bin-confusion/v/1.0.0
- https://www.npmjs.com/package/@selfpentest/bin-confusion/v/1.0.1
- https://github.com/advisories/GHSA-63mv-x2gw-8rg2

Compromised versions (1)

• = 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.