{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "dependencykfeg"
   },
   "versions": [
    "25.0.3"
   ]
  }
 ],
 "aliases": [],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/dependencykfeg/25.0.3"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "dependencykfeg 25.0.3 has no functionality of its own: its entry point exports an empty object and its package.json declares a single dependency, node-acct-utils, that is not fetched from the npm registry but from a tarball URL on GitHub (https://github.com/GamerD11/ping_test/raw/refs/heads/main/node-acct-utils-1.0.0.tgz), hosted in the repository GamerD11/ping_test. The code that runs at install time is therefore not part of the published package, and the publisher has already replaced it once. The tarball runs `node index.js` as a preinstall script and silently ignores errors; the tarball's own entry point is the same script, so requiring the dependency repeats the beacon. The first version of the tarball (sha256 af59a1f75fb309422693a656404504c4ab7c25d31a70bf0c36cf2454dea35f43, served until 2026-10-29 22:01 UTC) is lightly obfuscated; it runs `whoami` and `hostname`, reads the working directory, home directory, platform, CPU architecture and Node.js version, and sends them as JSON in an HTTP POST to http://yrtew6v4g3w9myixyizv5cvfa6gx4zso.oastify.com/. The current version (sha256 2707f1c7c853cd703495678ade5e3819a98620f5f6b6ca247b962d727b3ff84a) downloads the collector host name from https://raw.githubusercontent.com/GamerD11/ping_test/main/burp_collaborator.txt (at the time of writing 378jcbb9w8ce23y2enf0lhbkqbw2k58u.oastify.com) and does nothing if that file is empty; otherwise it runs `whoami` and `hostname`, queries https://ipinfo.io/json for the machine's public IP address, network operator and ASN, and sends those together with the home directory, working directory, platform, architecture and Node.js version in an HTTPS POST to that host with certificate verification disabled. Impact: any developer or CI machine that installs the package discloses its identity, filesystem layout and public network location to a third party, and the publisher can replace the install-time code with a harmful payload at any moment without publishing a new npm version. Remediation: remove the package, install with --ignore-scripts where possible, reject dependencies resolved from URLs outside the registry, and block oastify.com on build hosts. Versions 25.1.3 and 25.1.9 of the same package belong to the same campaign.",
 "id": "PROTET-NPM-2026-130",
 "modified": "2026-10-29T22:39:02Z",
 "published": "2026-10-29T21:59:02Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/dependencykfeg/25.0.3"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Package pulls a GitHub-hosted dependency whose install script sends user, host and public IP data to an oastify.com host"
}