Malicious code in @aerodrome-finance/contracts (npm)
A malicious npm package named @aerodrome-finance/contracts was published, typosquatting the legitimate @aerodrome-finance scope. The package contained code that auto-executes on npm install, stealing credentials and environment variables from multiple locations and sending them to a hardcoded webhook endpoint.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed @aerodrome-finance/contracts from npm during the malicious package's availability window.
- Ecosystems
- Attack vectors
- Affected entities
- @aerodrome-finance/contractsMalicious npm package typosquatting the legitimate @aerodrome-finance scope
A malicious npm package @aerodrome-finance/contracts was discovered and reported by the OpenSSF. The package name typosquats the legitimate @aerodrome-finance scope, increasing the likelihood of accidental installation by developers.
Upon installation, lifecycle hooks automatically execute index.js, which performs credential harvesting from multiple locations including ~/.aws/, ~/.ssh/, ~/.kube/, ~/.docker/, ~/.netrc, ~/.npmrc, ~/.pypirc, ~/.git-credentials, and key directories for Foundry, gcloud, Solana, Anchor, and Sui. The script also scrapes process.env for variables matching patterns such as KEY, TOKEN, SECRET, PASS, PRIVATE, MNEMONIC, AWS, GITHUB, NPM, WALLET, and SEED.
The harvested credentials are exfiltrated via HTTPS POST to a hardcoded webhook.site endpoint. The exfiltration is performed by a detached child process that sleeps 60-240 seconds before sending, designed to outlive the npm install process and evade security scanning windows.
The malicious code includes sandbox and honeypot evasion techniques: hostname regex checks for scan-, detonation, sandbox, and ubuntu-fc-uvm prefixes; checks for non-root/sandbox user contexts; environment variable checks for canarytoken/honey indicators; and detection of npm mirror registries.
Indicators of compromise
- Packages
- @aerodrome-finance/contracts
Remediation
- Immediately audit npm install logs and CI/CD pipelines for any installation of @aerodrome-finance/contracts
- Rotate all credentials and secrets that may have been exposed (AWS keys, SSH keys, GitHub tokens, NPM tokens, wallet seeds, etc.)
- Review ~/.aws/, ~/.ssh/, ~/.kube/, ~/.docker/, ~/.netrc, ~/.npmrc, ~/.pypirc, ~/.git-credentials, and key directories for unauthorized access or modifications
- Scan process environment variables and .env files for any exfiltration activity
- Update npm package lock files to remove @aerodrome-finance/contracts and verify the legitimate @aerodrome-finance package is used instead
- Implement package name verification and typosquatting detection in dependency management workflows
- Monitor webhook.site or any external endpoints for data exfiltration attempts
Sources
- GitHub Advisory GHSA-wj9v-gmm3-32pv · GitHub Advisory Database
Cite this entry
"Malicious code in @aerodrome-finance/contracts (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 11, 2026. https://supplychainattack.org/incident/malicious-code-in-aerodrome-finance-contracts-npm-tlj14g
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - containedcritical
Malicious code in @polymarkets/clob-client-v2 (npm)
@polymarkets/clob-client-v2 (npm) is a malicious package that typosquats the legitimate @polymarket scope and redirects its inquirer dependency to a lookalike npm registry (registrynpmjs.to) to deliver arbitrary code execution during installation and on first require.
npmTyposquattingCompromised packageDependency confusion