dependencykfeg

{"schema_version":"1.7.4","id":"MAL-2026-18416","published":"2026-10-29T20:56:46Z","modified":"2026-11-03T05:03:52.826272233Z","aliases":["GHSA-7p3p-8gfg-8grq"],"summary":"Malicious code in dependencykfeg (npm)","details":"dependencykfeg 25.0.3, 25.1.3 and 25.1.9 contain no code of their own and declare a single dependency that npm fetches from a tarball in the GitHub repository `GamerD11/ping_test` (`https://github.com/GamerD11/ping_test/raw/refs/heads/main/node-acct-utils-1.0.0.tgz`), whose `preinstall` script runs `node index.js` on install. The first version of the tarball sends the username, hostname, home and working directories, platform, architecture and Node.js version in an HTTP POST to `yrtew6v4g3w9myixyizv5cvfa6gx4zso.oastify.com`; the current version, swapped in on 2026-10-29, reads the collector host from `burp_collaborator.txt` in the same repository, adds the machine's public IP address, network operator and ASN from `ipinfo.io`, and sends everything over HTTPS with certificate verification disabled. The packages have no legitimate functionality, the data is collected without the user's knowledge, and because the install-time code lives outside the registry on a mutable branch, the publisher can replace it with a harmful payload at any time without a new npm release. Any machine that installed one of these versions has disclosed its identity and network location to a third party; the other published versions are not part of this report.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (b1d6fe89dfa7e3ac7b6bb69388ac3d1584a4756a53f2b58f490739f409663324)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"dependencykfeg","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["25.0.3","25.1.3","25.1.9","2.1.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7p3p-8gfg-8grq"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/dependencykfeg"}],"database_specific":{"iocs":{"domains":["yrtew6v4g3w9myixyizv5cvfa6gx4zso.oastify.com","378jcbb9w8ce23y2enf0lhbkqbw2k58u.oastify.com"],"files":[{"digests":{"sha256":"e843c768cff370d9c172918ff78d2e233f86fe3e02a7b147cfa484c5f41d2f00"},"note":"second stage v1 (GamerD11/ping_test commit aab6519c20): preinstall HTTP POST of user, host and paths to oastify.com","paths":["node_modules/node-acct-utils/index.js"],"source":"DROPPED"},{"digests":{"sha256":"10718a307135d20b94153375c1fdf473a437d2cf98673bc09be86a81c51bd25d"},"note":"second stage v2 (GamerD11/ping_test commit e74e024638): adds ipinfo.io lookup, HTTPS POST to the host in burp_collaborator.txt","paths":["node_modules/node-acct-utilssss21/index.js"],"source":"DROPPED"}],"urls":["https://github.com/GamerD11/ping_test/raw/refs/heads/main/node-acct-utils-1.0.0.tgz","https://raw.githubusercontent.com/GamerD11/ping_test/main/burp_collaborator.txt"]},"malicious-packages-origins":[{"id":"GHSA-7p3p-8gfg-8grq","import_time":"2026-10-30T18:19:43.151933241Z","modified_time":"2026-10-30T18:04:34Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"b1d6fe89dfa7e3ac7b6bb69388ac3d1584a4756a53f2b58f490739f409663324","source":"ghsa-malware"}]},"credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"},{"name":"Robin Frehner, Protet","contact":["https://protet.io","mailto:hello@protet.io"],"type":"FINDER"}]}