Supply chain · npm · High

Critical npm package 'web-main' (v22.1.2) performs host reconnaissance on install

Threat Engine Auto-Feed · data current as of 2026-09-14

A malicious version of the npm package 'web-main' (22.1.2) executes a preinstall script that collects system information and exfiltrates it to an external server. This package poses a critical risk for credential and secret theft, as it performs host reconnaissance upon installation within a development or build environment.

  • Package: npm / web-main
  • Affected versions: = 22.1.2
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'web-main' version 22.1.2 contains malicious code that automatically executes during the 'npm install' process. This script gathers sensitive system information, including hostname, user details, platform architecture, home directory, and output from 'whoami', 'id', and 'pwd' commands. This collected data is then exfiltrated to an attacker-controlled endpoint.

How the attack works

This is a supply-chain attack leveraging a malicious software package. The attacker published a compromised version of a package to a public registry. When a user or automated system installs this specific version, a preinstall script embedded within the package automatically runs. This script performs reconnaissance by collecting system details and then transmits this information to an external server controlled by the attacker, without providing any legitimate functionality.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that pull npm packages, especially if configured to fetch the latest versions or unpinned dependencies
  • Any system where 'web-main' version 22.1.2 was installed

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing for automatic updates to vulnerable versions
  • Lack of package-lock.json or yarn.lock to ensure deterministic dependency resolution
  • Use of internal package mirrors that do not vet or scan for malicious packages
  • Installation of packages in environments with access to sensitive credentials or network resources

Blast-radius scenarios

  • An attacker gains reconnaissance data about the compromised host, including user and system identifiers, which can be used for further targeted attacks.
  • The exfiltrated information could reveal details about the build environment, potentially aiding in lateral movement or privilege escalation within the affected system or network.
  • Installation in a CI/CD environment could expose build server configurations, user accounts, or access tokens if they are accessible during the install phase.

What to do (defensive)

Detect

  • Scan dependency trees for 'web-main' version 22.1.2.
  • Monitor network traffic for outbound connections to 'https://smi54v4uvb9q7ve5t6fnyro16scj0co1.oastify.com/system-info' or other suspicious external endpoints during package installation.
  • Review package-lock.json or yarn.lock files for unexpected changes or the presence of the malicious version.
  • Implement software composition analysis (SCA) tools to identify known malicious packages.

Contain

  • Immediately quarantine any systems where 'web-main' version 22.1.2 was installed.
  • Block network access to 'https://smi54v4uvb9q7ve5t6fnyro16scj0co1.oastify.com/system-info' at the firewall or proxy level.
  • Revoke and rotate any credentials or API keys that were present or accessible on compromised systems during the installation time frame.
  • Isolate build environments and development machines from production networks.

Remediate

  • Remove 'web-main' version 22.1.2 from all projects and dependency trees.
  • Update package.json files to pin dependencies to known good versions and use lockfiles (package-lock.json, yarn.lock) to ensure deterministic builds.
  • Rebuild affected systems from trusted images after ensuring all malicious components are removed.
  • Educate developers on the risks of installing unvetted or suspicious packages and the importance of dependency hygiene.

Frontier verdict — High

Prioritize immediate detection and removal of 'web-main' v22.1.2 due to its critical severity and host reconnaissance capabilities upon installation.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.