@coopeuch/button

GHSA-gwpw-pvv6-cxg3

Malicious code in @coopeuch/button (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.999.999`

## Source: amazon-inspector (ee1a3bb0818d46a9c83659ed32f8ab209477970658d5f6f8241a12c96d137c98)
The package's postinstall lifecycle script (postinstall.js) runs automatically on `npm install` and harvests installer host identifiers — hostname, username, uid/gid, home directory, non-internal network interfaces with MAC addresses and CIDRs, configured DNS servers, reverse-DNS internal FQDN, CPU/memory, the consumer package name/version/path, CI markers, npm_config_* values, and container runtime indicators — then POSTs the JSON report over HTTPS to the hardcoded host collector.oob.s4yhii.com at /_npm-poc/beacon and issues a DNS lookup for a label-prefixed subdomain of oob.s4yhii.com as an out-of-band beacon. The destination is not the installer's own infrastructure and is not caller-configurable. The `@coopeuch` scope combined with the 1.999.999 version has the shape of dependency-confusion targeting of a specific organization's internal namespace, in which `npm install` resolves this public package in place of an intended internal one and emits the fingerprint to the author's collector.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/npm/@coopeuch/button/MAL-2026-17759.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/npm/@coopeuch/button/MAL-2026-17759.json
- https://www.npmjs.com/package/@coopeuch/button/v/1.999.999
- https://github.com/advisories/GHSA-gwpw-pvv6-cxg3

Compromised versions (1)

= 1.999.999

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.