GHSA-x4jx-pc3h-93v6: Malicious code in @sxm-content-creators/tools-ds (npm)
@sxm-content-creators/tools-ds is a dependency-confusion package with no functional code (its description is "Authorized Test Package"). Its postinstall script runs node ./index.cjs on npm install, which POSTs the hostname, home directory, platform and CI provider (GitHub Actions, GitLab CI, Azure Pipelines or Jenkins) to https://130.162.231.177:8443/. It was published by the npm account notsemz, which published two more packages with the same beacon on 2026-10-29 and seven placeholder-only names.
--- -= Per source details. Do not edit below this line.=-
Source: ghsa-malware (3413962fd6b4924514c7e2ea2fcc30b6c751163a8a798ffa5d38c21b4da941e8) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this package's malicious activity?
Any computer where the package is installed or run should be treated as fully compromised. Installation triggers its postinstall script, which sends the hostname, home directory, platform, and detected CI provider information to an external server.
Are CI environments affected?
Yes. The package specifically detects GitHub Actions, GitLab CI, Azure Pipelines, and Jenkins, and reports the detected provider along with host information. CI runners that installed the package should be treated as compromised.
What should be done if the package was installed?
Rotate all secrets and keys stored on the affected computer immediately, using a different computer. Remove the package, but do not assume removal eliminates malicious software or restores trust in the host.
How can I determine whether the package was installed?
Review npm dependencies and installation records for @sxm-content-creators/tools-ds. Systems or CI jobs where it was installed or run should be handled as compromised.