et_phone_home (npm): malicious postinstall script phones home to bare IPv4 host on every install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
OpenSSF flagged the npm package etphonehome as malicious (GHSA-22c9-84j8-wjjv, MAL-2026-18607). Version 0.0.5 contains a postinstall script that runs automatically on install and uses wget to fetch a path from a bare IPv4 address, contacting a remote host from every machine that installs the package. The package has no legitimate source code, no patched versions, and has been removed/flagged as malware (CWE-506). Reach is limited (~36 downloads/month, 1 dependent repo), but any developer or CI machine that installed 0.0.5 executed the malicious code and reached out to attacker infrastructure. There is no fix; the only remediation is removal and host triage.
What to do
- Check lockfiles and CI logs for et_phone_home@0.0.5 and remove it from all dependency trees
- Audit machines and CI runners that installed it: inspect for follow-on wget-fetched payloads, persistence, and outbound connections to the bare IPv4 host
- Rotate credentials and secrets accessible from affected build environments
- Block the contacted IP at network egress and hunt logs for prior connections
- Rebuild affected artifacts from clean environments
Sources
All live incidents on Threat Watch
