osep-react-antdnpm
Malicious code in osep-react-antd (npm) Remove it immediately and rotate any exposed credentials.
What this malware does
package.json declares preinstall: node index.js, which runs automatically on npm install. index.js collects host identifiers (os.hostname(), process.platform, arch, os.homedir(), os.userInfo() including uid/gid/username/shell, cwd) and the output of whoami and id via child_process, then POSTs the JSON payload to a hardcoded URL https://qtn11857tbs7r8jtj0bj2250xr3jrafz.oastify.com/detox56. The oastify.com host is Burp Suite Collaborator out-of-band infrastructure used to receive callbacks from compromised installers. The package name mimics React/Ant Design naming conventions and ships empty author/description/license metadata with no functional code beyond the beacon — the dependency-confusion squat shape. Installer harm: every npm install of this package leaks the installer's hostname, username, uid/gid, and shell to the attacker, identifying internal corporate environments and CI runners for follow-on targeting.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Backdoor / remote accessFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for osep-react-antd (version 10.10.11). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging osep-react-antd across your stack and pipelines.
If you installed it — respond
osep-react-antd establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If osep-react-antd was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks osep-react-antd before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks osep-react-antd-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.