@demica/resources

GHSA-p35r-x7g3-mccw

Malicious code in @demica/resources (npm)

Details

**Severity:** Critical

**Affected versions:** `> 0`

**Note:** *This report is updated by a verification record*

Dep-confusion squat of internal @demica/resources at sentinel high version 99.99.100 + auto-exec postinstall (canary.js) beaconing to RAW IP 157.230.17.236:80/dc. Sentinel-high-version + auto-exec beacon = MALICIOUS per operator policy (c913); "authorized canary" framing does NOT downgrade, raw-IP dest matches masterkrweb. 6-pkg @demica canary campaign.## Source: amazon-inspector (98805b03541bafd28883acb75e8fd9d0e4ea947d75062563c34438dec82139bf)
On `npm install`, the package's `scripts.postinstall` executes `canary.js`, which issues an unconditional plain-HTTP GET to the hardcoded bare IP `157.230.17.236` on port 80 at path `/dc?...`. The query string includes `os.hostname()` (truncated to 200 chars) plus the package name, version, a nonce, and a phase identifier. This fires automatically on every install with no opt-out. The package self-describes as a 'dependency-confusion canary,' but it is published on the public npm registry under the `@demica/*` scope: any installer that resolves `@demica/resources` — including via accidental dependency confusion, typo, or curiosity install — will leak their hostname to the operator of that bare IP over unencrypted HTTP. The destination is an anonymous bare IP with no associated domain, publisher, or disclosure; hostname is an installer-side host identifier transmitted off-host to an attacker-shaped endpoint.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/be6382940bda7f3b21b5b0bb4343e6a13809b911/osv/malicious/npm/@demica/resources/MAL-2026-5350.json))

**References:**
- https://app.safedep.io/community/malysis/01KTMB44098ATG3YSX2G0Q9M23
- https://github.com/ossf/malicious-packages/blob/be6382940bda7f3b21b5b0bb4343e6a13809b911/osv/malicious/npm/@demica/resources/MAL-2026-5350.json
- https://www.npmjs.com/package/@demica/resources/v/99.99.100
- https://www.npmjs.com/package/@demica/resources/v/99.99.99
- https://github.com/advisories/GHSA-p35r-x7g3-mccw

Compromised versions (1)

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.