@brick-v2/icons@999.0.2
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
OpenSSF/OSV Malicious Advisory
imported 14d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-17717 confirms this npm version as malicious.
Advisory
MAL-2026-17717
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @brick-v2/icons (npm)
Details
@brick-v2/icons@999.0.3 is a dependency-confusion credential stealer. The package's package.json declares a preinstall script `node index.js`, and index.js's only behavior is to require a platform-specific prebuilt native addon from `prebuilds/<platform>-<arch>/metrics.node`. The native binary reads a curated list of CI and cloud secrets from the environment — AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, SYSTEM_ACCESSTOKEN, ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN, AZURE_DEVOPS_EXT_PAT, and similar — along with hostname, username, cwd, and OS fields, and POSTs them as JSON to the hardcoded attacker endpoint `oob.s4yhii.com` at path `/native`. The JS shim presents a benign Angular-style facade (`forRoot`, `createLogger`, `version` exports) under a plausible scoped name, while the real behavior lives in the opaque native binary; no build system, binding.gyp, or source is shipped. The inflated version `999.0.3` is designed to win semver resolution against any legitimate internal `@brick-v2/icons` package, targeting private registries via dependency confusion. Harm is auto-executed on `npm install` via the preinstall hook, before any user code runs.
Independent scan evidence
public snapshotBehavioral surface
DynamicRequireEnvironmentVars
NoLicense
Source & flagged code
2 flagged · loading sourceindex.jsView file
1'use strict';
L2: var pkg = require('./package.json');
L3: var path = require('path');
Medium
prebuilds/linux-x64/metrics.nodeView file
•path = prebuilds/linux-x64/metrics.node
kind = native_binary
sizeBytes = 16560
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
prebuilds/linux-x64/metrics.nodeView on unpkgFindings
3 Medium1 Low
MediumDynamic Requireindex.js
MediumEnvironment Vars
MediumShips Native Binaryprebuilds/linux-x64/metrics.node
LowNo License
Affected versions and remediation
This report applies to @brick-v2/icons@999.0.2.
See all versions of @brick-v2/icons for other recorded verdicts.
- Avoid installing @brick-v2/icons@999.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.