Malicious npm package @axon-web/icons 99.0.0 leaks hostname, username via OAST DNS beacon
Severity: critical · Patch status: no-fix-needed · Since 2026-11-01
OpenSSF and Amazon Inspector flagged the npm package @axon-web/icons version 99.0.0 as malicious, published to the GitHub Advisory Database on 2026-11-01 (GHSA-jh68-cxw4-pfj2). On require, index.js builds an identifier from os.hostname() and process.env.USER/USERNAME and performs a DNS lookup against a subdomain of an interactsh/OAST collector (oast.fun), leaking the installer's hostname and OS username to attacker-controlled DNS infrastructure. The same file enumerates process.env keys matching token, secret, key, pass, aws, github, and npm patterns and prints the matching key names to stdout, indicating reconnaissance of credential-bearing environment variables. The package contains no icon content and appears to be a dependency-confusion or typosquat payload. No patched version exists; the package should be treated as compromised and removed.
What to do
- Check lockfiles and dependency trees for @axon-web/icons@99.0.0 and remove it; treat any environment that installed it as potentially probed
- Rotate credentials whose environment-variable names match token/secret/key/pass/aws/github/npm patterns on affected machines
- Review DNS and proxy logs for queries to *.oast.fun subdomains to identify installations that beaconed
- Audit for dependency-confusion exposure: pin internal-scope packages to private registries and enable npm provenance/integrity checks
- Block the OAST domain in egress/DNS filtering
Sources
All live incidents on Threat Watch
