OpenSSF/OSV advisory MAL-2026-3309 confirms this npm version as malicious. Malicious npm package published by the `microsop` threat actor as part of a dependency-confusion campaign that impersonates internal tooling at Microsoft, Google Cloud, and PayPal using inflated semver values (e.g. 99.9.x, 100.1.x) to win npm resolution against private internal packages. All packages in the campaign falsely advertise themselves as "Security Research PoC" and execute on `preinstall` via `node...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in google-cloud-secret-manager-config-poc (npm)
Details
Malicious npm package published by the `microsop` threat actor as part of a dependency-confusion campaign that impersonates internal tooling at Microsoft, Google Cloud, and PayPal using inflated semver values (e.g. 99.9.x, 100.1.x) to win npm resolution against private internal packages. All packages in the campaign falsely advertise themselves as "Security Research PoC" and execute on `preinstall` via `node index.js`, exfiltrating to disposable `webhook.site` endpoints.
This package targets Google-Cloud-flavored internal naming and performs SSH key validation/fingerprinting on the build host. On install it checks for `/root/.ssh/id_rsa`, runs `ssh-keygen -l -f` to extract the key fingerprint and `ssh-keygen -y -f` to derive the public key, then POSTs `{hostname, fingerprint, public_key, key_exists}` to `https://webhook.site/813b99f6-c86c-4a1f-9318-518a3c153992` tagged `status: KEY_VALIDATION_RESULT`. The captured fingerprint and public key let the operator correlate the install host against authorized-keys lists for downstream lateral movement.
---
## Source: amazon-inspector (a4735e524b9623da4da209d597cdc515ed3f0cd2534591e1d98539d5b5f11f4c) The package google-cloud-secret-manager-config-poc was found to contain malicious code.
## Source: ossf-package-analysis (daa2f2438668b4ed2d4a869c9cd52cc3e989b235e08652eb8a041db22c222ae2) The OpenSSF Package Analysis project identified 'google-cloud-secret-manager-config-poc' @ 99.9.14 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.