Supply chain · npm · High

Malicious npm package 'lumen-pages-community' exfiltrates system data on install

Threat Engine Auto-Feed · data current as of 2026-08-22

The npm package 'lumen-pages-community' version 9.9.9 contains malicious code that exfiltrates system information during installation. This package exhibits characteristics of a dependency confusion attack, potentially targeting organizations that use internal package names without proper scoping. Exposure is high due to the critical severity and the nature of data exfiltration.

  • Package: npm / lumen-pages-community
  • Affected versions: = 9.9.9
  • Severity: critical
  • Reach: ~159/wk
  • Exposure: 70/100 (High)

What happened — Malicious package

The npm package 'lumen-pages-community' version 9.9.9 includes a postinstall hook that automatically executes a script named 'dc.js'. This script collects sensitive system information, including hostname, username, current working directory, platform, Node version, CI environment variables, and npm user-agent. This collected data is then transmitted via an HTTPS GET request to a hardcoded third-party collector URL.

How the attack works

This is a malicious package attack, specifically resembling a dependency confusion tactic. An attacker publishes a public package with a name likely used internally by an organization. If an organization's build system or developer environment is configured to prioritize public registries or lacks proper scope configuration, it might inadvertently pull the malicious public package instead of an intended internal one. The package's postinstall script then executes, allowing the attacker to collect information from the compromised system without direct interaction.

Who's exposed

Profiles most at risk

  • Organizations and development teams using the npm ecosystem
  • CI/CD pipelines configured to pull the latest versions of dependencies
  • Developers who might install packages from public registries without strict validation

Conditions that increase exposure

  • Unpinned or loosely versioned dependencies that could resolve to the malicious version
  • Lack of lockfiles (e.g., package-lock.json) to ensure consistent dependency resolution
  • Internal package mirrors or registries that do not properly scope or block public packages with conflicting names
  • Build environments with broad network access that allow outbound connections to arbitrary URLs

Blast-radius scenarios

  • An attacker gains reconnaissance data about the compromised system, including host details and user context.
  • The exfiltrated data could be used to map internal network structures, identify build environments, or inform subsequent targeted attacks.
  • Installation on developer machines or CI/CD agents could expose sensitive environment variables or internal network details.

What to do (defensive)

Detect

  • Scan dependency trees for 'lumen-pages-community@9.9.9'.
  • Monitor network traffic for outbound connections to 'https://webhook.site/b00492c6-27ba-4ea0-a9cb-dd50b3770250/dc' or similar suspicious endpoints.
  • Review package.json and package-lock.json files for unexpected dependencies or version changes.
  • Inspect `postinstall` scripts in `node_modules` for unusual or unauthorized commands.

Contain

  • Immediately quarantine any systems identified as having installed 'lumen-pages-community@9.9.9'.
  • Block network access to the exfiltration URL 'https://webhook.site/b00492c6-27ba-4ea0-a9cb-dd50b3770250/dc' at the perimeter firewall and proxy levels.
  • Implement strict package naming conventions and scoped registries for internal packages to prevent dependency confusion.
  • Ensure all build and development environments operate with the principle of least privilege and restricted network egress.

Remediate

  • Remove 'lumen-pages-community@9.9.9' from all affected projects and environments.
  • Update `package.json` files to use specific, pinned versions for all dependencies and regenerate `package-lock.json`.
  • Review and rotate any credentials or API keys that may have been exposed on compromised build systems or developer machines.
  • Educate developers on the risks of dependency confusion and the importance of verifying package authenticity and integrity.

Frontier verdict — High

Prioritize immediate detection and removal of 'lumen-pages-community@9.9.9' due to critical data exfiltration risk and potential for dependency confusion.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.