@heartlandone-private/fontawesome-pronpm
@heartlandone-private/fontawesome-pro is a confirmed malicious npm package (MAL-2026-11093) that typosquats a legitimate package to trick installs (malicious versions 6.3.2, 6.3.3, 6.3.6). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @heartlandone-private/fontawesome-pro (npm)
What this malware does
The package's postinstall lifecycle hook runs node index.js, which issues an HTTPS GET to a hardcoded Burp Collaborator subdomain at e0fumpwx24ddfmenzmg0izs2atgk4es3.oastify.com/dependency-confusion with a User-Agent identifying it as a dependency-confusion probe. On any npm install that resolves this scoped name, the request fires automatically and discloses installer identity (source IP, DNS resolver, timing, request metadata) to a third-party out-of-band interaction server controlled by whoever provisioned the Collaborator instance. The package name uses a private-scope pattern (@heartlandone-private/fontawesome-pro) that mimics an internal artifact, consistent with a dependency-confusion attempt aimed at organizations whose internal @heartlandone-private scope is not reserved on the public registry. Whether the operator's intent is authorized red-team testing or opportunistic exploitation, any consumer whose install pipeline resolves this public package receives install-time code execution and outbound network signalling to an attacker-controlled callback.
The OpenSSF Package Analysis project identified '@heartlandone-private/fontawesome-pro' @ 6.3.3 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
TyposquatFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @heartlandone-private/fontawesome-pro (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @heartlandone-private/fontawesome-pro across your stack and pipelines.
If you installed it — respond
@heartlandone-private/fontawesome-pro is a typosquat — you almost certainly intended a legitimately-named package. Remove @heartlandone-private/fontawesome-pro, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If @heartlandone-private/fontawesome-pro was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @heartlandone-private/fontawesome-pro before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- OpenSSF: Package Analysis · finder
Detect & block this
O3 blocks @heartlandone-private/fontawesome-pro-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.