MAL-2026-18416

Dashboard / Malicious Package / MAL-2026-18416

MAL-2026-18416

Summary: Malicious code in dependencykfeg (npm)

Details: dependencykfeg 25.0.3, 25.1.3 and 25.1.9 contain no code of their own and declare a single dependency that npm fetches from a tarball in the GitHub repository `GamerD11/ping_test` (`https://github.com/GamerD11/ping_test/raw/refs/heads/main/node-acct-utils-1.0.0.tgz`), whose `preinstall` script runs `node index.js` on install. The first version of the tarball sends the username, hostname, home and working directories, platform, architecture and Node.js version in an HTTP POST to `yrtew6v4g3w9myixyizv5cvfa6gx4zso.oastify.com`; the current version, swapped in on 2026-10-29, reads the collector host from `burp_collaborator.txt` in the same repository, adds the machine's public IP address, network operator and ASN from `ipinfo.io`, and sends everything over HTTPS with certificate verification disabled. The packages have no legitimate functionality, the data is collected without the user's knowledge, and because the install-time code lives outside the registry on a mutable branch, the publisher can replace it with a harmful payload at any time without a new npm release. Any machine that installed one of these versions has disclosed its identity and network location to a third party; the other published versions are not part of this report. Source: ghsa-malware (b1d6fe89dfa7e3ac7b6bb69388ac3d1584a4756a53f2b58f490739f409663324) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References: https://github.com/advisories/GHSA-7p3p-8gfg-8grq, https://www.npmjs.com/package/dependencykfeg