Supply chain · npm · High

Malicious npm package 'simplenewnpmpackage' performs dependency confusion probing

Threat Engine Auto-Feed · data current as of 2026-09-23

The npm package 'simplenewnpmpackage' version 1.0.2 contains malicious code that beacons system information upon import. This package is designed for dependency confusion or namesquatting probes, indicating potential reconnaissance against environments where it is installed. Organizations should immediately identify and remove this package to prevent further information leakage.

Package: npm / simplenewnpmpackage
Affected versions: = 1.0.2
Severity: critical
Reach: ~0/wk
Exposure: 60/100 (High)

What happened — Malicious package

The npm package 'simplenewnpmpackage' version 1.0.2 includes malicious code that, upon being required or imported, sends an HTTPS GET request to a hardcoded interactsh OAST subdomain. This request transmits the installer's operating system platform and hostname as query parameters. The package's sole function is this out-of-band beacon.

How the attack works

This attack leverages a malicious package to perform reconnaissance. When the package is loaded, it establishes an outbound connection to a controlled server, transmitting basic system information. This pattern is characteristic of dependency confusion or namesquatting probes, where an attacker attempts to identify systems that might mistakenly install a public package instead of an intended private one, or a similarly named legitimate package.

Who's exposed

Profiles most at risk

Development teams using the npm ecosystem
CI/CD pipelines that pull unpinned or latest versions of dependencies
Organizations with internal package mirrors or registries that might not strictly enforce package naming conventions

Conditions that increase exposure

Unpinned dependencies in package.json files (e.g., using '*' or '^' for 'simplenewnpmpackage')
Absence of strict lockfiles (e.g., package-lock.json) in deployment environments
Internal package names that conflict with public npm package names, leading to dependency confusion
Environments where outbound network connections are not strictly monitored or filtered

Blast-radius scenarios

An attacker gains knowledge of internal hostnames and operating system platforms within an organization's infrastructure.
The successful installation indicates a potential vulnerability to dependency confusion attacks, which could lead to further compromise if more sophisticated malicious packages are introduced.
Compromised build environments or developer workstations if the package is installed there, providing reconnaissance data to an adversary.

What to do (defensive)

Detect

Scan project dependencies for 'simplenewnpmpackage' version 1.0.2.
Monitor network traffic for outbound HTTPS GET requests to 'dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun'.
Review package-lock.json or yarn.lock files for unexpected entries or changes.

Contain

Isolate any systems or environments where 'simplenewnpmpackage' version 1.0.2 is detected.
Block network access to 'dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun' at the firewall or proxy level.
Review and update dependency management policies to prevent the installation of unvetted or suspicious packages.

Remediate

Remove 'simplenewnpmpackage' version 1.0.2 from all affected projects and environments.
Update package.json files to explicitly pin dependency versions and regenerate lockfiles.
Implement or reinforce dependency integrity checks and supply chain security practices, such as using private registries with strict access controls and package review processes.
Conduct an internal audit to identify any other potential dependency confusion vulnerabilities.

Frontier verdict — High

Prioritize immediate detection and removal of 'simplenewnpmpackage' due to its critical severity and role in reconnaissance for potential dependency confusion attacks.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.