sc-font-icons@9999.0.0
Malicious code in sc-font-icons (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
The package sc-font-icons@9999.0.0 is a dependency-confusion package. Its preinstall hook (callback.js) collects the installer's hostname, username, current working directory, npm registry URL, and CI/CD environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME) and exfiltrates them via HTTP GET to 75[.]119[.]137[.]232:31337/depconfuse?pkg=sc-font-icons&h=...&u=...&d=...®=...&ci=...&t=...
- analyzed by
- Leitwacht
- first seen
- Aug 2, 2026, 07:34 PM
- analyzed
- Aug 2, 2026, 07:35 PM
Related advisories
- break-after@9999.0.0
- dust-helpers@9999.0.0
- widget-forge@9999.0.0
- editor_application@9999.0.0
- application_base@9999.0.0
- appsignal@9999.0.0
- speaker_tagging_media_player@9999.0.0
- beaver-ui-breadcrumbs@0.0.2
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.