# MAL-2026-12435: Malicious code in sc-geeksquad-core (npm)


- **Type:** Malicious package
- **Package:** `sc-geeksquad-core` (npm)
- **Published:** 5 Aug 2026

## What is MAL-2026-12435?

MAL-2026-12435 is a malicious package in sc-geeksquad-core, published on 5 Aug 2026. 

### Official description

sc-geeksquad-core@9999.0.0 declares a preinstall script `node callback.js` that runs automatically on `npm install`. The script collects the installer's hostname (`os.hostname()`), OS username (`os.userInfo().username`), current working directory (`process.cwd()`), configured npm registry (`npm_config_registry`), and a set of CI repository-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME), then sends them via HTTP GET to the hardcoded bare-IP endpoint `http://75.119.137.232:31337/depconfuse` as query parameters. The placeholder version `9999.0.0` combined with a generic scoped-sounding name is the canonical dependency-confusion reconnaissance shape: the package is published to public npm to intercept internal-package name resolution and beacon back which private-namespace builds are vulnerable to substitution.

The OpenSSF Package Analysis project identified 'sc-geeksquad-core' @ 99.9.1 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

## What should I do about MAL-2026-12435?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-12435 is a malicious package: sc-geeksquad-core (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-12435/ (Markdown: https://insights.sbomify.com/MAL-2026-12435/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-12435

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-12435/
Summaries are generated and may contain mistakes; the official description above is the record.