@bluewin/utils

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the `@bluewin` scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs `node postinstall.js` on npm install, which sends an HTTPS request to `https://5w2cezr3af2i0rvm72x74empvg18pzdo.oastify.com/bluewin/utils`, a Burp Collaborator endpoint, disclosing the installing host's IP address and that it installed the package. It collects no further data, but unreviewed code from an outside publisher has run with the installing user's privileges. The npm account securityresearch1 published it on 2026-10-01.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/4a4c6e9677b4a9d383802167510e64e4fa603e1f/osv/malicious/npm/@bluewin/utils/MAL-2026-17437.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/4a4c6e9677b4a9d383802167510e64e4fa603e1f/osv/malicious/npm/@bluewin/utils/MAL-2026-17437.json
- https://www.npmjs.com/package/@bluewin/utils
- https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/@bluewin/utils/MAL-2026-17437.json
- https://www.npmjs.com/package/@bluewin/utils/v/1.0.0
- https://github.com/advisories/GHSA-9ggj-2v34-hwv8

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.