did-0091
This report shows the evidence for did-0091@11.2.8. 5 of 5 known versions are blocked or flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-4177 confirms this npm version as malicious.
Advisory
MAL-2026-4177
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in did-0091 (npm)
Details
On `npm install`, the package's postinstall script runs `node -e` to fetch the installer's public IP from api.ipify.org, execute `id || ver && whoami && hostname`, and collect hostname, cwd, and USERDOMAIN/COMPANY environment variables. The bundle is POSTed to a hardcoded interactsh subdomain at lszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun. The package has no legitimate function: description is 'xxx', main file index.js is 0 bytes, and the only behavior is the install-time beacon. Combined with the unusual name shape, this matches dependency-confusion reconnaissance campaigns that probe corporate networks via Project Discovery's interactsh out-of-band service.
## Source: ossf-package-analysis (80bf373136eb0315910e5ba3fa9097db2cd7efe316d1defbb9b8b78f8ab8506b) The OpenSSF Package Analysis project identified 'did-0091' @ 11.0.6 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to did-0091@11.2.8.
The same advisory and Firewall decision cover 5 recorded versions
11.0.5, 11.0.6, 11.0.9, 11.1.8, 11.2.8
The versions list below shows the verdict for each recorded version.
- Avoid installing did-0091@11.2.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.