Dependency-confusion beacon: ms-client-portal npm package phones home on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-02
A malicious dependency-confusion package, ms-client-portal, was published to npm on 2026-10-31 by account amahrou1a (versions 1.0.0 and 10.0.0). It contains no functional code; its README claims the name is an internal project name leaked in a health-sector client portal's production bundle. Its preinstall and postinstall scripts run node -e one-liners that send HTTP GET beacons to http://38.242.235.206/depconf/ms-client-portal/preinstall (and /postinstall) with the username (USER/USERNAME), hostname and working directory in the query string, exfiltrating developer environment details. The same account published internal-renderers and pandafortunerush the same day with identical beacons to the same server. GitHub advisory GHSA-q9p6-j8q4-8qh9 (CWE-506) lists no patched versions; the packages remain on npm. Any organisation whose internal package names were exposed publicly and whose developers run npm install is at risk.
What to do
- Search npm lockfiles and CI logs for ms-client-portal, internal-renderers and pandafortunerush and for connections to 38.242.235.206; treat any install as a compromise of the build host's environment details
- Block 38.242.235.206 at egress and disable npm install lifecycle scripts (npm config set ignore-scripts true) in CI and developer machines
- Audit internal package names for public exposure in web bundles and register them as placeholders in npm scopes
- Rotate any credentials present on machines where the packages were installed and review build/CI telemetry for further compromise
Sources
All live incidents on Threat Watch
