Supply chain · npm · High

Critical npm package 'hunterone-build-probe-9210' steals credentials

Threat Engine Auto-Feed · data current as of 2026-08-16

The npm package 'hunterone-build-probe-9210' version 1.0.5 contains malicious code designed to exfiltrate sensitive environment information and credentials during installation. This poses a critical supply-chain risk, as it can compromise developer machines or CI/CD environments where the package is installed, leading to unauthorized access to systems and data.

  • Package: npm / hunterone-build-probe-9210
  • Affected versions: = 1.0.5
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'hunterone-build-probe-9210' version 1.0.5 includes malicious code that executes automatically via preinstall and postinstall hooks in its package.json. This code gathers system information, environment variables, and specific credential files, then transmits this data to a hardcoded external collector.

How the attack works

This is a credential/secret theft attack. Upon installation, the malicious package executes a script that collects sensitive data such as hostname, platform, network interfaces, current working directory, user ID, process environment variables, root filesystem listing, and the contents of '~/.npmrc'. It specifically targets AWS_CONTAINER_CREDENTIALS_RELATIVE_URI. The collected information is then sent to an external, unauthorized third-party endpoint.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that pull npm packages, especially if configured to fetch the latest versions
  • Organizations with internal npm mirrors that have synchronized this malicious package

Conditions that increase exposure

  • Projects with unpinned dependencies that might inadvertently pull version 1.0.5 of 'hunterone-build-probe-9210'
  • Environments lacking strict lockfile enforcement (e.g., package-lock.json, yarn.lock)
  • Build systems or developer machines where 'hunterone-build-probe-9210' is installed directly or as a transitive dependency
  • Environments where npm registry authentication tokens or AWS ECS credentials are accessible during package installation

Blast-radius scenarios

  • An attacker could gain access to npm registry authentication tokens, enabling them to publish malicious packages under the compromised user's identity.
  • Compromised AWS ECS credentials could grant an attacker unauthorized access to AWS resources and services.
  • Exfiltrated environment variables and system information could provide attackers with valuable reconnaissance for further attacks or lateral movement within an organization's infrastructure.

What to do (defensive)

Detect

  • Scan existing projects and dependencies for 'hunterone-build-probe-9210' version 1.0.5.
  • Monitor network traffic from build environments for suspicious outbound connections to unknown or untrusted domains, specifically 'webhook.site/22508080-b099-4ec3-8ab7-7354af2886a9/buildenv'.
  • Implement software composition analysis (SCA) tools to identify known malicious packages in your dependency tree.
  • Review package.json files for unexpected 'preinstall' or 'postinstall' scripts, especially in newly added or less-known dependencies.

Contain

  • Immediately quarantine any systems (developer machines, CI/CD agents) found to have installed 'hunterone-build-probe-9210' version 1.0.5.
  • Block network access to 'webhook.site' from all development and build environments.
  • Prevent further installation of 'hunterone-build-probe-9210' version 1.0.5 by configuring package managers or internal registries to deny or flag it.
  • Rotate all npm registry authentication tokens and AWS credentials that were active on compromised systems during the package installation.

Remediate

  • Remove 'hunterone-build-probe-9210' version 1.0.5 from all projects and dependency trees.
  • Ensure all dependencies are pinned to known good versions using lockfiles (e.g., package-lock.json, yarn.lock) and commit them to version control.
  • Implement a policy of least privilege for build environments and CI/CD pipelines, ensuring they only have access to necessary resources and credentials.
  • Educate developers on the risks of supply-chain attacks and the importance of vetting third-party packages.

Frontier verdict — High

Prioritize immediate detection and removal of 'hunterone-build-probe-9210' version 1.0.5 due to critical credential theft capabilities.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.