dpg-media-7ehemelnpm
Advisory published Updated
dpg-media-7ehemel is a confirmed malicious npm package (MAL-2026-14411) that steals credentials and exfiltrates sensitive data (malicious version 999.9.15). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in dpg-media-7ehemel (npm)
What this malware does
npm package [email protected] executes node index.js from a preinstall lifecycle script that harvests installer identity and environment context and beacons it to the hardcoded host da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun. The script collects os.hostname(), username/home/cwd/INIT_CWD, local and public IP addresses (via https.get to api.ipify.org / icanhazip.com / ifconfig.me), resolver IPs, and CI metadata (repo, actor, run id, workflow, AWS region), and spawns gh api user --jq.login, npm whoami, and git config user.email to attribute the environment to a specific developer/org, plus reads parent project package.json fields. The payload is serialized as JSON, hex-encoded, chunked to 60-character DNS labels, and exfiltrated both via dns.resolve subdomain queries (${i}-${c}.u-${uuid}.<callback>) and via HTTP/HTTPS POST to /poc/${uuid} on the same callback host. The version string 999.9.15 and the developer-identity harvest are characteristic of a dependency-confusion beacon targeting a private-scope name. Any self-description as authorized research is contradicted by the DNS-tunneling exfiltration channel and the absence of installer consent.
The OpenSSF Package Analysis project identified 'dpg-media-7ehemel' @ 999.9.15 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Search your lockfiles and build artifacts for dpg-media-7ehemel (version 999.9.15).
If you installed it — respond
dpg-media-7ehemel is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If dpg-media-7ehemel was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- OpenSSF: Package Analysis · finder
Detect & block this
O3 blocks dpg-media-7ehemel-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.