@coopeuch/common

GHSA-pcjv-x9w3-wc2g

Malicious code in @coopeuch/common (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.999.999`

## Source: amazon-inspector (887c41c0805d7d223c499e702796cf46727b0be152b7c8a65607907afb3b5d59)
@coopeuch/[email protected] publishes to the public npm registry under a scope the publisher does not own, using an inflated version (1.999.999) consistent with the dependency-confusion technique that outranks internal-registry versions. The package's declared postinstall script (postinstall.js) runs automatically on npm install and collects installer-side host and network data — hostname, username, uid/gid, home directory, non-internal network interface addresses with MAC/CIDR, DNS resolver addresses, reverse-DNS internal FQDN, container markers, CI environment-variable presence, npm_config_registry, and the consuming project's package name/version/declared range — then POSTs it as JSON to the hardcoded author-controlled endpoint https://collector.oob.s4yhii.com/_npm-poc/beacon. A secondary DNS beacon is emitted via dns.lookup to a subdomain of oob.s4yhii.com. Any build that resolves @coopeuch/common from the public registry (including internal builds referencing the @coopeuch scope) will auto-exfiltrate internal hostnames, MAC addresses, usernames, internal registry URLs, and project identity to a third-party collector at install time. The package's README self-labels this as a coordinated-disclosure proof of concept; the harvesting and off-host upload nonetheless occur without installer opt-in.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/npm/@coopeuch/common/MAL-2026-17760.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/npm/@coopeuch/common/MAL-2026-17760.json
- https://www.npmjs.com/package/@coopeuch/common/v/1.999.999
- https://github.com/advisories/GHSA-pcjv-x9w3-wc2g

Compromised versions (1)

= 1.999.999

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.