Supply chain · npm · High

Malicious npm package 'eslint-config-compact-base' beacons host reconnaissance data

Threat Engine Auto-Feed · data current as of 2026-09-24

A critical malicious npm package, 'eslint-config-compact-base' version 1.0.0, collects host and CI environment reconnaissance data upon module load. This data, including hostname, username, and repository name, is exfiltrated to an attacker-controlled endpoint, posing a significant risk to development and CI environments.

  • Package: npm / eslint-config-compact-base
  • Affected versions: = 1.0.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Malicious package

The npm package 'eslint-config-compact-base' version 1.0.0 contains malicious code that executes unconditionally when the module is loaded. This code gathers host reconnaissance data, such as operating system platform, hostname, username, architecture, Node version, and current working directory. It also collects CI-context environment variables, including CI, RUNNER_NAME, and GITHUB_REPOSITORY. This collected information is then sent to a hardcoded attacker-controlled AWS API Gateway endpoint via HTTPS.

How the attack works

This is a malicious package attack where a seemingly benign software component is compromised to perform unauthorized actions. Upon installation and loading, the package's code activates, collects sensitive system and environment information, and then covertly transmits this data to an external server controlled by the attacker. This type of attack leverages the trust placed in software dependencies to gain initial access and gather intelligence from the compromised environment.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull npm packages
  • Any team whose build or install processes include 'eslint-config-compact-base' version 1.0.0

Conditions that increase exposure

  • Projects with unpinned dependencies that might inadvertently pull the malicious version
  • Environments without strict package integrity checks or lockfiles
  • CI/CD systems configured to automatically fetch the latest versions of dependencies
  • Internal package mirrors that have synchronized the malicious version

Blast-radius scenarios

  • An attacker gains reconnaissance data about the host system, including its identity and environment details.
  • Compromised CI/CD environments could expose repository names and internal network configurations.
  • The exfiltrated data could be used for further targeted attacks or to map an organization's infrastructure.

What to do (defensive)

Detect

  • Scan dependency trees for 'eslint-config-compact-base' version 1.0.0.
  • Monitor network traffic for outbound connections from build or development environments to 'https://cbrsuo9293.execute-api.us-east-1.amazonaws.com/c'.
  • Review package integrity using checksums or cryptographic signatures if available.

Contain

  • Immediately quarantine any systems or CI/CD runners found to have installed 'eslint-config-compact-base' version 1.0.0.
  • Block network access to 'https://cbrsuo9293.execute-api.us-east-1.amazonaws.com/c' from all internal networks.
  • Prevent further installations of 'eslint-config-compact-base' version 1.0.0 across all development and CI environments.

Remediate

  • Remove 'eslint-config-compact-base' version 1.0.0 from all projects and package caches.
  • Audit logs for any outbound connections to the identified malicious endpoint from affected systems.
  • Rotate credentials and API keys that may have been exposed in compromised CI/CD environments.
  • Ensure all dependencies are pinned to known good versions and utilize lockfiles to prevent unexpected dependency updates.

Frontier verdict — High

Prioritize immediate detection and removal of 'eslint-config-compact-base' v1.0.0 due to critical host reconnaissance and data exfiltration risks.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.