red-bull-venue-tools

Details

**Severity:** Critical

**Affected versions:** `= 19.2.1`

The package communicates with a domain associated with malicious activity.## Source: amazon-inspector (3b5fe5829b1fbc9d863be9bad876998565a13ebc95fecc9ccc5600f92ecd423b)
package.json declares preinstall=`node index.js`, which fires automatically on `npm install`. index.js collects host reconnaissance — os.hostname(), os.platform()/arch, os.homedir(), os.userInfo() (username/uid/gid/shell), `whoami` and `id` shell command output via child_process.exec, OS info, and cwd — and POSTs the JSON payload to a hardcoded Burp Collaborator OAST subdomain at https://theyfiesr9w2p5moyrr9yn6lscy3mvak.oastify.com/detox56. The package name impersonates a Red Bull brand namespace, consistent with a targeted reconnaissance / dependency-confusion probe against an internal Red Bull build environment. Installer harm is concrete: every `npm install` of this version leaks installer identity and host fingerprint to an attacker-controlled out-of-band destination.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/09450c65be5425dcbf77e56de64aab892c95995f/osv/malicious/npm/red-bull-venue-tools/MAL-2025-5455.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/09450c65be5425dcbf77e56de64aab892c95995f/osv/malicious/npm/red-bull-venue-tools/MAL-2025-5455.json
- https://www.npmjs.com/package/red-bull-venue-tools/v/19.2.1
- https://github.com/advisories/GHSA-9vhv-w77h-3658

Compromised versions (1)

• = 19.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.