Supply chain · npm · High

Critical Malicious npm Package 'com.epi.e2e_test' Gathers Host Data

Threat Engine Auto-Feed · data current as of 2026-09-30

A critical malicious npm package, 'com.epi.e2e_test' version 1.2.2, automatically collects sensitive host identifiers and package metadata upon installation. This behavior, characteristic of reconnaissance beacons, poses a high risk for organizations using this package, potentially leading to further targeted attacks.

  • Package: npm / com.epi.e2e_test
  • Affected versions: = 1.2.2
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Malicious package

The npm package 'com.epi.e2e_test' version 1.2.2 contains malicious code that executes a preinstall script. This script gathers host identifiers such as home directory, hostname, username, DNS server information, and the current working directory, along with the contents of the package.json file. This collected data is then transmitted via HTTPS to an external host, meta.brs.cx.

How the attack works

This is a malicious package attack where code embedded within a legitimate-looking software component executes automatically during the installation process. The attack leverages preinstall scripts to run arbitrary code without explicit user interaction, enabling data exfiltration or system reconnaissance immediately upon dependency resolution.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Organizations with internal npm mirrors that may have ingested this package

Conditions that increase exposure

  • Projects with unpinned dependencies that resolve to 'com.epi.e2e_test@1.2.2'
  • Lack of package lockfiles (e.g., package-lock.json, yarn.lock) to ensure deterministic builds
  • Environments where network egress to unknown external hosts is not restricted

Blast-radius scenarios

  • An attacker gains reconnaissance data about the build environment or developer workstation, including system identifiers and project metadata.
  • The collected data could be used to identify targets for subsequent, more sophisticated supply-chain attacks or social engineering.
  • Compromised systems could lead to further network penetration or data breaches within the organization.

What to do (defensive)

Detect

  • Scan dependency trees for 'com.epi.e2e_test@1.2.2' in package.json and lockfiles.
  • Monitor network traffic for outbound connections to 'meta.brs.cx' from build systems or developer machines.
  • Review npm package integrity and preinstall/postinstall scripts during package onboarding or audits.

Contain

  • Immediately quarantine any systems or build environments found to have installed 'com.epi.e2e_test@1.2.2'.
  • Block network access to 'meta.brs.cx' at the perimeter and host firewalls.
  • Remove 'com.epi.e2e_test' from any internal package registries or caches.

Remediate

  • Remove 'com.epi.e2e_test@1.2.2' from all project dependencies and rebuild applications.
  • Force-update all dependencies to known good versions, utilizing lockfiles to ensure deterministic builds.
  • Rotate credentials for any systems or services that may have been exposed during the package installation.
  • Implement stricter dependency management policies, including pinning versions and reviewing package scripts before integration.

Frontier verdict — High

Prioritize immediate detection and removal of 'com.epi.e2e_test@1.2.2' due to critical data exfiltration risk and potential for follow-on attacks.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.