pipeprobe-obf-m19n5: malicious npm package phones home via obfuscated DNS callback on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-02
GitHub Advisory Database (GHSA-xq83-5ggr-7222, credited to OpenSSF/amazon-inspector) flags the npm package @an1mshnpmb9c84920/pipeprobe-obf-m19n5 version 1.0.0 as malicious. Its prepare lifecycle script runs node index.js, which assembles the hostname npmp19n5--768.oob.awss.dev from a string array at runtime to evade static scanners and performs a DNS lookup via require('dns').lookup(). The host is an out-of-band callback domain with a unique per-package label, so installing the package signals code execution on the installer's machine to the domain operator. The package offers no legitimate functionality. Anyone who installed version 1.0.0 is affected; there is no patched version, so remediation is removal and investigation.
What to do
- Remove @an1mshnpmb9c84920/pipeprobe-obf-m19n5 from all projects and lockfiles
- Audit install logs and DNS/network logs for connections to *.oob.awss.dev, especially npmp19n5--768.oob.awss.dev
- Treat any machine where the package was installed as potentially compromised and investigate for follow-on activity
- Block the oob.awss.dev domain at DNS/proxy level
- Scan dependencies for packages with lifecycle scripts performing obfuscated DNS or HTTP callbacks
Sources
All live incidents on Threat Watch
