Malicious code in agora402-payment-utils (npm)
The npm package agora402-payment-utils contains malicious code that replaces caller-supplied recipient addresses with a hardcoded Ethereum wallet (0xA930Ca05ea5548aE8ea0817087833A96453BED08) in payment routing functions. Additionally, a postinstall script exfiltrates installer metadata to an external webhook without consent.
- Disclosed
- Last updated
- Blast radius
- Any application using agora402-payment-utils for payment routing; all installers of the package receive telemetry exfiltration.
- Ecosystems
- Attack vectors
- Affected entities
- agora402-payment-utilsnpm package with hardcoded wallet substitution and telemetry exfiltration
The agora402-payment-utils npm package was published with intentional malicious functionality disguised as a payment utility library. The package's public API functions (validateRecipient, routePayment, processPayment) silently discard the caller-supplied recipient address and unconditionally route all payments to a hardcoded Ethereum wallet address (0xA930Ca05ea5548aE8ea0817087833A96453BED08). In-source code comments explicitly label this substitution as the 'malicious part' disguised as a 'safety feature'.\n\nBeyond payment redirection, the package includes a postinstall.js script that executes during npm install. This script POSTs a JSON payload containing the package name, the hardcoded wallet address, a timestamp, and the installer's working directory (process.cwd()) to a hardcoded webhook.site endpoint. This telemetry collection occurs without installer consent and sends sensitive environment information to a non-first-party endpoint.\n\nAny application using this library for payment processing would silently route funds to the attacker's wallet instead of intended recipients. The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- agora402-payment-utils
- Domains
- webhook.site
- Hashes
- 3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f
Remediation
- Immediately remove agora402-payment-utils from all projects and dependencies
- Audit all payment transactions routed through applications that used this package for unauthorized transfers to 0xA930Ca05ea5548aE8ea0817087833A96453BED08
- Review npm install logs and process working directories that may have been exfiltrated via the postinstall webhook
- Replace with a legitimate, audited payment utility library from a trusted source
- Implement package integrity verification and supply chain security scanning in CI/CD pipelines
- Monitor npm registry for similar typosquatting or malicious variants of payment utility packages
Sources
- GitHub Advisory GHSA-mcf9-m7mc-4cw5 · GitHub Advisory Database
Cite this entry
"Malicious code in agora402-payment-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-agora402-payment-utils-npm-1mve3a
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in ranux-pro (npm)
The npm package ranux-pro contained malicious code disguised as a network socket library. The package shipped a multi-tenant WhatsApp bot with obfuscated code and a mutable dependency override pointing to a personal GitHub account, allowing attackers to execute arbitrary code at install and runtime.
npmCompromised packageMalicious commit