sm-oauth

GHSA-7x7x-6w24-fch9

Malicious code in sm-oauth (npm)

Details

**Severity:** Critical

**Affected versions:** `= 99.0.0`

## Source: amazon-inspector (98d60527238d1284ed569a2fa7611ff2b430e1ebfab579f597f42a1eb28f49bc)
package.json declares preinstall and postinstall scripts that run `curl -s http://16.192.173.5/sm-oauth/pre` and `curl -s http://16.192.173.5/sm-oauth/post` on every `npm install`. The requests fire against a hardcoded bare-IP endpoint over plain HTTP, leaking the installer's network identity (source IP, install event, request metadata) to that endpoint and giving the operator a channel to serve follow-on content in the HTTP response. index.js self-identifies as a dependency-confusion test artifact and exports no functional library code; the package's only behavior on install is the outbound callback.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e307a23db650fb76255155feb9c7f2fecd528fef/osv/malicious/npm/sm-oauth/MAL-2026-14398.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e307a23db650fb76255155feb9c7f2fecd528fef/osv/malicious/npm/sm-oauth/MAL-2026-14398.json
- https://www.npmjs.com/package/sm-oauth/v/99.0.0
- https://github.com/advisories/GHSA-7x7x-6w24-fch9

Compromised versions (1)

= 99.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.