Malicious code in @aerodrome-finance/slipstream (npm)

The npm package @aerodrome-finance/slipstream was published with malicious code disguised as a legitimate library for Aerodrome Slipstream AMM contracts and ABIs. The package contained only an index.js file executed via preinstall and postinstall lifecycle hooks during installation.\n\nUpon installation, the malicious code enumerated process environment variables matching credential patterns (KEY, TOKEN, SECRET, PASS, PRIVATE, MNEMONIC, AWS, GITHUB, NPM, WALLET, SEED, etc.) and read sensitive files from the installer's system, including ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.npmrc, ~/.netrc, ~/.docker, ~/.foundry/keystores, and Solana/Sui key material. The code also searched for .env files containing additional secrets.\n\nThe collected data was serialized and sent to a detached Node subprocess that slept 60–240 seconds before POSTing the JSON payload to https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09. The code included sandbox evasion logic, bailing out when hostname or user matched indicators such as scan-, detonation, sandbox, ubuntu-fc-uvm, honey, canarytokens, or npmmirror.\n\nThe package name was a typosquat impersonating the legitimate Aerodrome Finance DeFi project, and the credential harvest list specifically targeted crypto and DeFi developers. The incident was identified by the OpenSSF malicious-packages project."