@heartlandone-private/fontawesome-pronpm
Advisory published Updated
@heartlandone-private/fontawesome-pro is a confirmed malicious npm package (MAL-2026-11093) that typosquats a legitimate package to trick installs (malicious versions 6.3.2, 6.3.3, 6.3.6). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @heartlandone-private/fontawesome-pro (npm)
What this malware does
The package's postinstall lifecycle hook runs node index.js, which issues an HTTPS GET to a hardcoded Burp Collaborator subdomain at e0fumpwx24ddfmenzmg0izs2atgk4es3.oastify.com/dependency-confusion with a User-Agent identifying it as a dependency-confusion probe. On any npm install that resolves this scoped name, the request fires automatically and discloses installer identity (source IP, DNS resolver, timing, request metadata) to a third-party out-of-band interaction server controlled by whoever provisioned the Collaborator instance. The package name uses a private-scope pattern (@heartlandone-private/fontawesome-pro) that mimics an internal artifact, consistent with a dependency-confusion attempt aimed at organizations whose internal @heartlandone-private scope is not reserved on the public registry. Whether the operator's intent is authorized red-team testing or opportunistic exploitation, any consumer whose install pipeline resolves this public package receives install-time code execution and outbound network signalling to an attacker-controlled callback.
The OpenSSF Package Analysis project identified '@heartlandone-private/fontawesome-pro' @ 6.3.3 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
TyposquatFind it
Search your lockfiles and build artifacts for @heartlandone-private/fontawesome-pro (3 malicious versions).
If you installed it — respond
@heartlandone-private/fontawesome-pro is a typosquat — you almost certainly intended a legitimately-named package. Remove @heartlandone-private/fontawesome-pro, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If @heartlandone-private/fontawesome-pro was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- OpenSSF: Package Analysis · finder
Detect & block this
O3 blocks @heartlandone-private/fontawesome-pro-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.