---
title: "Typosquatt alert ! Malicious npm Package: nyc-config"
description: "Possible typosquatting against @istanbuljs/load-nyc-config with ~25M weekly downloads."
url: "https://safedep.io/blog/nyc-config-malicious-package"
author: "SafeDep Team"
published: "2025-03-13"
---

# Typosquatt alert ! Malicious npm Package: nyc-config

Recently, we discovered a malicious npm package [nyc-config](https://www.npmjs.com/package/nyc-config) in our internal Open Source Software (OSS) package monitoring dashboard. It involved sending user system data to external domains. It is a possible typosquatt attack against the widely adopted [@istanbuljs/load-nyc-config](https://www.npmjs.com/package/@istanbuljs/load-nyc-config), which boasts ~25M weekly downloads.

## Discovery and Analysis

Our automated malware analysis flagged the `nyc-config` package as malicious due to System Information Exfiltration. Upon manual inspection, we observed that the package's `package.json` file contained a `preinstall` script designed to execute the `index.js` file during installation step itself. This script was crafted to gather sensitive system information such as:

- Hostname
- Operating system details
- Local and public IP addresses
- Username
- Current working directory

The collected data was then exfiltrated to remote servers controlled by the attacker.

You can view the analysis here - https://platform.safedep.io/community/malysis/01JP01T1WQPNGAG516NDS9A6ST

## Community Engagement

Recognizing the severity of this threat, we promptly reported our findings to the Open Source Security Foundation (OSSF) - https://github.com/ossf/malicious-packages/pull/839

## Conclusion

This incident underscores the critical importance of being cautious when incorporating third-party packages, ensuring they originate from trusted sources. By staying vigilant and fostering collaborative efforts, we can collectively mitigate the risks posed by malicious actors and fortify the security of our development environments.