ms-client-portal

GHSA-q9p6-j8q4-8qh9

Malicious code in ms-client-portal (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

ms-client-portal is a dependency-confusion package with no functional code; its README says the name is an internal project name exposed in the production web bundle of a health-sector client portal. Its preinstall and postinstall scripts each run a `node -e` one-liner on npm install that sends an HTTP GET to `http://38.242.235.206/depconf/ms-client-portal/preinstall` (and `/postinstall`) with the user name (`USER` or `USERNAME`), hostname and working directory in the query string. The npm account amahrou1a published versions 1.0.0 and 10.0.0 on 2026-10-31, and earlier the same day two more packages, internal-renderers and pandafortunerush, with the same beacon to the same server.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/76d9972934d78e9e71144d57c681280fa323f6c4/osv/malicious/npm/ms-client-portal/MAL-2026-18449.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/76d9972934d78e9e71144d57c681280fa323f6c4/osv/malicious/npm/ms-client-portal/MAL-2026-18449.json
- https://www.npmjs.com/package/ms-client-portal
- https://github.com/advisories/GHSA-q9p6-j8q4-8qh9

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.