Supply chain · npm · High

Malicious npm package 'take-home-caller-id' performs reconnaissance and data exfiltration

Threat Engine Auto-Feed · data current as of 2026-09-22

The npm package 'take-home-caller-id' version 1.0.1 contains malicious code that executes during installation. This code collects system information and sensitive files, then exfiltrates the data to an external server. Users who installed this package are exposed to potential credential and secret theft.

  • Package: npm / take-home-caller-id
  • Affected versions: = 1.0.1
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'take-home-caller-id' version 1.0.1 includes a preinstall hook that executes an `index.js` script upon installation. This script gathers host identifiers, user information, home directory details, DNS server lists, current working directory, and reads `/etc/passwd` and `/etc/hosts` files. The collected data is then transmitted via HTTPS to a Burp Collaborator subdomain, which is an out-of-band host used for exfiltration.

How the attack works

This is a supply-chain attack where a malicious package is introduced into a software ecosystem. The attack leverages a preinstall hook, a common mechanism in package managers, to execute arbitrary code during the installation process. This allows the attacker to perform reconnaissance and exfiltrate sensitive data from the host system without requiring the package's legitimate functionality to be invoked.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any system where 'take-home-caller-id' version 1.0.1 was installed

Conditions that increase exposure

  • Unpinned dependencies in `package.json` allowing automatic updates to malicious versions
  • Lack of `package-lock.json` or equivalent lockfiles to ensure consistent dependency versions
  • Use of internal package mirrors that do not vet or scan for malicious packages
  • Installation of packages from untrusted or unverified sources

Blast-radius scenarios

  • An attacker gains access to host identifiers, user information, and system configuration details, aiding in further targeted attacks.
  • Sensitive data from `/etc/passwd` and `/etc/hosts` could be exfiltrated, potentially revealing user accounts and internal network mappings.
  • The compromised system could be used as a pivot point for lateral movement within an organization's network.

What to do (defensive)

Detect

  • Review `package.json` files for `take-home-caller-id` version 1.0.1.
  • Scan `node_modules` directories for the presence of `take-home-caller-id` version 1.0.1.
  • Monitor network traffic for outbound connections to `0decr93bem6onemg3dmbydi6rxxrli97.oastify.com` or other suspicious Burp Collaborator domains.
  • Inspect package `preinstall` or `postinstall` scripts for unusual or obfuscated code.

Contain

  • Immediately isolate any systems identified as having installed `take-home-caller-id` version 1.0.1.
  • Block network access to `0decr93bem6onemg3dmbydi6rxxrli97.oastify.com` at the firewall and proxy levels.
  • Remove `take-home-caller-id` from all project dependencies and `node_modules` directories.
  • Implement strict package version pinning using `package-lock.json` or `yarn.lock`.

Remediate

  • Revoke and rotate any credentials or secrets that may have been present on compromised systems.
  • Force password resets for users whose information might have been exposed via `/etc/passwd`.
  • Perform a thorough forensic analysis on affected systems to determine the full extent of data exfiltration and compromise.
  • Update security policies to include mandatory package scanning and vetting for all third-party dependencies.

Frontier verdict — High

Prioritize immediate detection and removal of 'take-home-caller-id' due to critical severity credential/secret theft and data exfiltration risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.