Skip to content

Malicious code in dcfarguscert (npm)

Malware Published Aug 11, 2026 to the GitHub Advisory Database

Package

npm dcfarguscert (npm)

Affected versions

= 999.0.1

Patched versions

None

Description

Source: amazon-inspector (6b0841cccc5aa4961351a4cf991d7744a1d7acc4da3824321fed50e1e7b8657d)

dcfarguscert@999.0.1 registers both preinstall and postinstall lifecycle scripts that invoke src/telemetry.js. On install, telemetry.js collects host identifiers (os.hostname(), os.userInfo().username, OS release, process.platform, process.arch, Node version, CI flag) and the output of npm ls -g --depth=0 --json (the installer's globally installed npm package inventory), then POSTs the aggregated payload over plain HTTP to the hardcoded endpoint http://16-171-38-148.sslip.io:8080/api/install (bare IP 16.171.38.148 encoded via sslip.io). The version number 999.0.1 and the package description referencing a 'dependency test' with 'check ips' are consistent with a dependency-confusion beacon that fires unconditionally on install without any user consent or opt-out.


Credit: OpenSSF (source)

References

Published to the GitHub Advisory Database Aug 11, 2026
Reviewed Aug 11, 2026

EPSS score

Weaknesses

Embedded Malicious Code

The product contains code that appears to be malicious in nature. Learn more on MITRE.

GHSA ID

GHSA-mf24-fh58-62x2

Source code

No known source code
Improvements are not currently accepted on this advisory because this package is malware and has no patched versions. If there is something to change, please open an issue at https://github.com/github/advisory-database/issues.