---
id: "MAL-2026-12435"
kind: "package"
aliases: ["MAL-2026-12435"]
title: "Malicious code in sc-geeksquad-core (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "sc-geeksquad-core", "fixed": [], "affected": "= 9999.0.0; = 99.9.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-08-05T13:07:29+00:00"
first_seen_at: "2026-10-26T20:51:52+00:00"
updated_at: "2026-10-26T21:12:36+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-12435", "first_seen_at": "2026-10-26T20:51:52+00:00"}]
---

# Malicious code in sc-geeksquad-core (npm)

## Affected

- npm:sc-geeksquad-core affected = 9999.0.0; = 99.9.1 fixed ?

## Timeline

- 2026-10-26T20:51:52+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-12435

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2fd2458d8a5843f57187868a2c244a376dd3d2daef420d3c564c775ef6a2782a)
sc-geeksquad-core@9999.0.0 declares a preinstall script `node callback.js` that runs automatically on `npm install`. The script collects the installer's hostname (`os.hostname()`), OS username (`os.userInfo().username`), current working directory (`process.cwd()`), configured npm registry (`npm_config_registry`), and a set of CI repository-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME), then sends them via HTTP GET to the hardcoded bare-IP endpoint `http://75.119.137.232:31337/depconfuse` as query parameters. The placeholder version `9999.0.0` combined with a generic scoped-sounding name is the canonical dependency-confusion reconnaissance shape: the package is published to public npm to intercept internal-package name resolution and beacon back which private-namespace builds are vulnerable to substitution.

## Source: ossf-package-analysis (2094a7f35be1c723c65b36c32884f2f0e99840ef0bc090a1fbcb1f5568b93ef2)
The OpenSSF Package Analysis project identified 'sc-geeksquad-core' @ 99.9.1 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_