Supply chain · npm · High

Malicious npm package 'kmf-vendor-pack' (v99.0.0) leaks host data on install

Threat Engine Auto-Feed · data current as of 2026-10-09

A critical severity malicious package, 'kmf-vendor-pack' version 99.0.0, was identified in the npm ecosystem. It automatically executes a post-install script that communicates with an attacker-controlled domain, leaking system hostname and username. This poses a significant risk for developers and CI/CD environments that install this specific package version.

  • Package: npm / kmf-vendor-pack
  • Affected versions: = 99.0.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Malicious package

The npm package 'kmf-vendor-pack' version 99.0.0 contains malicious code that executes automatically during the 'npm install' process. This code initiates an HTTPS GET request to an attacker-controlled server, transmitting the installer's operating system hostname and username as query parameters. This action confirms code execution on the machine and leaks identifying data.

How the attack works

This is a malicious package attack where a seemingly legitimate software component is compromised to include harmful functionality. Upon installation, a 'postinstall' script is triggered, which is a common mechanism for packages to perform setup tasks. In this case, the script is weaponized to exfiltrate sensitive system information to an external, unauthorized server without user interaction.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that pull npm dependencies
  • Any system where 'kmf-vendor-pack' version 99.0.0 is installed

Conditions that increase exposure

  • Unpinned dependencies that could resolve to the malicious version
  • Lack of lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Internal package mirrors that may have cached the malicious version

Blast-radius scenarios

  • An attacker gains confirmation of code execution on the installer's machine.
  • Host-identifying data (hostname, username) is leaked to a third-party, potentially aiding further targeted attacks.
  • Compromised developer workstations or CI/CD environments could lead to broader supply chain breaches.

What to do (defensive)

Detect

  • Scan dependency trees for 'kmf-vendor-pack' version 99.0.0.
  • Monitor network traffic for outbound connections to 'db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast.pro'.
  • Review 'package.json' files for suspicious 'postinstall' scripts in dependencies.

Contain

  • Immediately quarantine any systems found to have installed 'kmf-vendor-pack' version 99.0.0.
  • Block network access to 'db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast.pro' at the perimeter.
  • Remove 'kmf-vendor-pack' version 99.0.0 from all package registries and caches.

Remediate

  • Remove 'kmf-vendor-pack' version 99.0.0 from all projects and ensure no other versions are affected.
  • Update all 'package.json' files to explicitly pin dependency versions and generate/update lockfiles.
  • Rotate credentials and review access logs for any systems that installed the malicious package, assuming potential compromise beyond initial data leakage.

Frontier verdict — High

This is a critical priority due to immediate data leakage and confirmed code execution on install, requiring urgent detection and remediation.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.