Scan report · 29 days agoPublic

www.npmjs.com

104.17.135.117AS13335 · US

Submittedhttps://www.npmjs.com/package/@octokit/auth-oauth-device

device-code phishing (GitHub) on non-legit host

Engine tags

Verdict

1 of 7 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 4.3 s · 26 requests

01 · Visitor openswww.npmjs.com/package/@octokit/auth-oauth-device

02 · Page shown

@octokit/auth-oauth-device - npm

03 · OutcomeToken theft — MFA includedThe code authorises the attacker's own sign-in at the real provider. Tokens are taken, not passwords.

Dangerous — confirmed threat

Automated

It shows a sign-in code and sends you to the real GitHub login page — a technique used to take over an account without ever seeing your password. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

Token theftDevice-code phishing (OAuth device-grant abuse)

Entering this trap's code at the real GitHub device-login screen authorizes an attacker's session — MFA included. Sign-in tokens are stolen, not passwords, so no credential form ever has to appear — which is why this slips normal phishing checks.

GitHub · GitHub device-login ref: github.com/login/device (via anchor); on non-legit host www.npmjs.com; code "WDJB-MJHT"; device-code instructions present

The page shows a sign-in code and steers you to the REAL GitHub device-login page to enter it. Doing so authorizes the attacker's own session — including your MFA — without ever asking for your password. That is why there is no login form on this page.

Analyst noteDefinitive: a device-login code + a link to the real provider on a non-legit host = device-code (device-authorization-grant) phishing. It bypasses MFA and steals tokens, not passwords. Treat as malicious; the impersonated provider is the takedown/abuse target.

File

The file was not analysed, so the scan carries no verdict on the file itself.

Infrastructure

IP: 104.17.135.117CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Oct 12, 2026

WHOIS

Registrar: MarkMonitor Inc.
Created: Mar 19, 2010
Expires: Mar 19, 2031
Nameservers: bayan.ns.cloudflare.comsandy.ns.cloudflare.com

14 malicious12 suspicious

Hashes & fingerprints

Page Hash9bb18d65be66eb5501e23399769d686dde358234944e85fd836412638ef44f68 DOM Hashc575a823142e235895922eef17edb1e1f4d1ad204282342fbb3b0c10b0987f86 Screenshot pHash897ccc80f3c1e5b6 JARM27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint067992B91617EDA01FAB7FC35F10C81C4C03EFA3 Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “@octokit/auth-oauth-device - npm”

Visit Site

Engines

7 · time to verdict