sheratan_haha

GHSA-8cf5-9c3x-69cv

Malicious code in sheratan_haha (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (6b473b40e0c041d34e85161ed8c91e0e00d006a0822698a0d3994876cb685ddd)
On `npm install`, the package's declared postinstall hook (`node postinstall.js`) runs `whoami` on the installer's machine and POSTs the output to a hardcoded webhook.site endpoint (`https://webhook.site/0ea9eb45-3ede-4cf0-9ea9-2b8d700272e7`) via `https.request`. The package advertises itself as 'A simple date formatting utility' but ships no library code consistent with that purpose — the only behavior on install is host fingerprinting and exfiltration to an attacker-controlled URL. Metadata is placeholder-shaped (empty author, generic description, name `sheratan_haha`), consistent with a dependency-confusion / recon PoC. Installing this package leaks the installer's OS username to an external endpoint controlled by the publisher.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/6936f1922896bcab7881ee1e43ea9b524b16026d/osv/malicious/npm/sheratan_haha/MAL-2026-5739.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/6936f1922896bcab7881ee1e43ea9b524b16026d/osv/malicious/npm/sheratan_haha/MAL-2026-5739.json
- https://www.npmjs.com/package/sheratan_haha/v/1.0.0
- https://www.npmjs.com/package/sheratan_haha/v/1.0.1
- https://github.com/advisories/GHSA-8cf5-9c3x-69cv

Compromised versions (1)

= 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.