Supply chain · npm · High

Malicious npm package `cisco-github-simple` leaks host reconnaissance

Threat Engine Auto-Feed · data current as of 2026-09-22

A malicious npm package, `cisco-github-simple` version 1.0.1, executes a preinstall script that collects sensitive host and account information. This data is then exfiltrated to an attacker-controlled domain, posing a supply-chain risk for organizations using the npm ecosystem.

  • Package: npm / cisco-github-simple
  • Affected versions: = 1.0.1
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Malicious package

The npm package `cisco-github-simple` version 1.0.1 contains malicious code that runs automatically during installation. This code gathers host reconnaissance data, including hostname, username, home directory, DNS server list, and the contents of `/etc/passwd` and `/etc/hosts`, along with the package's `package.json`.

How the attack works

This is a malicious package attack where a preinstall lifecycle hook is used to execute arbitrary code. The code collects system information and exfiltrates it to an external server, typically for reconnaissance or initial access. This type of attack often leverages typosquatting or dependency confusion to trick developers into installing the malicious package.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that pull npm dependencies
  • Organizations whose internal package names could be impersonated (e.g., those with a 'cisco-github' namespace)

Conditions that increase exposure

  • Unpinned dependencies that allow automatic updates to vulnerable versions
  • Lack of lockfiles (e.g., `package-lock.json`) to ensure consistent dependency resolution
  • Use of internal package mirrors without strict validation of upstream packages
  • Developers or automated systems installing packages without prior security vetting

Blast-radius scenarios

  • Installation of the package leads to the exfiltration of sensitive host and account information, providing attackers with reconnaissance data.
  • An attacker gains initial insights into the build environment or developer workstation, potentially leading to further targeted attacks.
  • Compromise of developer credentials or access to internal network resources if sensitive files are exposed.

What to do (defensive)

Detect

  • Scan `package.json` files for suspicious `preinstall` or other lifecycle hooks.
  • Monitor network traffic for outbound connections to unusual or untrusted domains during package installation.
  • Review dependency trees for unknown or unexpectedly named packages, especially those impersonating known vendors.
  • Utilize software composition analysis (SCA) tools to identify known malicious packages.

Contain

  • Immediately quarantine any systems or build environments where `cisco-github-simple` version 1.0.1 was installed.
  • Block network access to the exfiltration domain `prk15yh0sbkd1305h200c2wv5mbhz7nw.oastify.com`.
  • Remove `cisco-github-simple` from all `package.json` files and dependency trees.
  • Review and revoke any credentials that may have been exposed on compromised systems.

Remediate

  • Update `package.json` files to explicitly pin dependency versions to known good versions, avoiding `^` or `~` for critical dependencies.
  • Enforce the use of `package-lock.json` or similar lockfiles to ensure deterministic builds.
  • Implement strict package governance, including private registries with vetting processes for all third-party dependencies.
  • Educate developers on identifying and reporting suspicious packages and the risks of dependency confusion.

Frontier verdict — High

Prioritize immediate removal of `cisco-github-simple` and review systems for data exfiltration due to critical host reconnaissance leakage.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.