Supply chain · npm · High

Critical Malicious npm Package 'ragacateslikodi' Scrapes Localhost Data

Threat Engine Auto-Feed · data current as of 2026-09-17

The npm package 'ragacateslikodi' version 1.0.6 contains malicious code that, upon import, probes localhost:5000 for sensitive paths, extracts data, and exfiltrates it to an attacker-controlled endpoint. This poses a critical supply-chain risk for any environment where this package is installed and executed.

  • Package: npm / ragacateslikodi
  • Affected versions: = 1.0.6
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Malicious package

The npm package 'ragacateslikodi' version 1.0.6 was identified as malicious. When imported, it executes an immediate asynchronous function that attempts to access specific paths on http://localhost:5000. It then collects status codes, response lengths, and any content matching 'flag' patterns from these responses, subsequently transmitting this aggregated data to a hardcoded webhook.site URL.

How the attack works

This is a malicious package attack where an attacker publishes a seemingly innocuous or dependency-masquerading package to a public registry. Upon installation and execution within a development or production environment, the package's hidden malicious code activates. In this instance, the code performs reconnaissance on local services and exfiltrates potentially sensitive information, leveraging the trust placed in third-party dependencies.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that automatically pull the latest versions of dependencies
  • Any team whose applications or services directly or indirectly depend on 'ragacateslikodi' version 1.0.6

Conditions that increase exposure

  • Unpinned dependencies that could resolve to 'ragacateslikodi' version 1.0.6
  • Lack of package lockfiles (e.g., package-lock.json, yarn.lock) to ensure deterministic builds
  • Use of internal package mirrors that do not vet upstream packages for malicious content
  • Environments where sensitive services or data are exposed on http://localhost:5000

Blast-radius scenarios

  • An attacker could gain access to sensitive information from internal admin interfaces or 'flag' endpoints running on localhost:5000.
  • The exfiltrated data could be used for further reconnaissance, lateral movement, or to compromise internal systems.
  • Compromised build environments or developer workstations could lead to broader supply chain attacks.

What to do (defensive)

Detect

  • Scan your dependency trees for 'ragacateslikodi' version 1.0.6.
  • Monitor network egress for connections to 'https://webhook.site/1895d1d5-b227-4ce4-a2ce-232b1bec8b65' or other suspicious external endpoints from build or runtime environments.
  • Review package integrity and provenance for all npm dependencies, especially newly introduced ones.

Contain

  • Immediately quarantine any systems or environments found to have installed 'ragacateslikodi' version 1.0.6.
  • Block network access to 'https://webhook.site/1895d1d5-b227-4ce4-a2ce-232b1bec8b65' at your perimeter firewalls and proxies.
  • Isolate build agents and developer machines that may have interacted with the malicious package.

Remediate

  • Remove 'ragacateslikodi' version 1.0.6 from all projects and environments.
  • Update package lockfiles to explicitly pin known-good versions of all dependencies.
  • Conduct a thorough audit of any data that may have been exposed via localhost:5000 on affected systems.
  • Implement strict dependency vetting processes, including static analysis and behavioral monitoring for new packages.

Frontier verdict — High

Prioritize immediate detection and removal of 'ragacateslikodi' version 1.0.6 due to its critical severity and data exfiltration capabilities.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.