Malicious Code Vulnerability in cisco-github-simple Package
Summary
MAL-2026-16381: Malicious code in cisco-github-simple (npm). Affects cisco-github-simple versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cisco-github-simple package is an npm package that impersonates Cisco's GitHub namespace. It is designed to be installed via npm and is intended for use in JavaScript applications. However, this package contains malicious code that compromises user security by collecting sensitive information from the host system during installation.
Vulnerability Detail
The vulnerability originates from a preinstall lifecycle hook in the package that executes a script (node index.js) automatically during npm install. This script gathers sensitive host information, including the hostname, username, home directory, DNS server list, and contents of /etc/passwd and /etc/hosts. It then sends this data to an attacker-controlled domain, posing a significant risk of data leakage and unauthorized access to sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cisco-github-simpleIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no specific workarounds to mitigate this vulnerability other than avoiding the installation of the cisco-github-simple package altogether. If you need similar functionality, consider using alternative packages that do not have known vulnerabilities.
Conclusion
The cisco-github-simple package contains a serious vulnerability that exposes sensitive information to attackers. It is crucial to uninstall this package and avoid using it in the future. Regular monitoring of your project for vulnerabilities is recommended to maintain security.
See every vulnerability recorded for cisco-github-simple →
FAQ
It is an npm package that impersonates Cisco's GitHub namespace but contains malicious code that collects sensitive information.
The code runs a script during installation that gathers sensitive host information and sends it to an attacker-controlled domain.
You should immediately uninstall the package using the command: npm uninstall cisco-github-simple.
Yes, consider using other npm packages that provide similar functionality without known vulnerabilities.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner.
