registry / Malware / @dgn-src-click-to-pay-org/srcdcfreleasecert

@dgn-src-click-to-pay-org/srcdcfreleasecert

This report shows the evidence for @dgn-src-click-to-pay-org/srcdcfreleasecert@374.0.0. 2 of 2 known versions are blocked or flagged. See all versions.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

OpenSSF/OSV Malicious Advisory

imported 2mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13744 confirms this npm version as malicious.

Advisory

MAL-2026-13744

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @dgn-src-click-to-pay-org/srcdcfreleasecert (npm)

Details

The package's postinstall script POSTs installer metadata (package name/version, platform, arch, Node version, timestamp) over plain HTTP to a hardcoded sslip.io-wrapped bare IP at http://16-171-38-148.sslip.io:8080/api/install. The scoped name mimics an internal corporate org (@dgn-src-click-to-pay-org) and the version is inflated to 374.0.0, matching the canonical dependency-confusion pattern: a lure package published to the public registry to be resolved by internal build systems that mistakenly reach out for a namespace they expected to be private, with a callback that reports successful installs to an attacker-controlled endpoint. The beacon fires automatically on npm install with no user action, revealing internal build host presence and confirming which corporate targets are vulnerable to further dependency-confusion payloads.

References

OpenSSF/OSV advisory PACKAGE PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The package has a concrete undisclosed install-time network telemetry surface, but source inspection shows limited runtime fingerprint collection and no credential theft, payload execution, persistence, or destructive action. This merits a warning rather than a publish block.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Unconsented disclosure of package and runtime fingerprint data.

Mechanism

HTTP POST install telemetry

AI rationale

Evidence

package.jsonscripts/check-env.jssrc/index.jsREADME.md

Network endpoints1

16-171-38-148.sslip.io:8080/api/install

Independent scan evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for AI warning decision

package.json runs scripts/check-env.js at postinstall.
scripts/check-env.js POSTs install metadata without user action.
Default endpoint is http://16-171-38-148.sslip.io:8080/api/install.
Payload includes OS platform, architecture, Node version, package/version, and timestamp.

Evidence against

src/index.js contains only local formatting, PAN masking, and Luhn helpers.
No credential, file, child-process, dynamic-code, or persistence behavior found.
README.md describes the exported local helpers but not the install telemetry.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.37 KB of source, external domains: 16-171-38-148.sslip.io

Source & flagged code

1 flagged

package.jsonView file

•scripts.postinstall = node scripts/check-env.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/check-env.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 High2 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to @dgn-src-click-to-pay-org/srcdcfreleasecert@374.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @dgn-src-click-to-pay-org/srcdcfreleasecert@374.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-13 23:45:11.380Z (UTC).

Source advisory published: 2026-08-11 18:50:11.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

374.0.0latestshownMaliciousMalwareBlockPublishedAug 11, 2026, 5:29 PM 999.0.1MaliciousMalwareBlockPublishedAug 11, 2026, 5:25 PM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Related packages

Other malware packages

Source & flagged code