Malicious code in api-rust-sdk (npm)
The npm package api-rust-sdk contained malicious code in its postinstall hook that harvested credentials (Solana keypairs, Rust configs, dotenv secrets), exfiltrated files matching attacker-defined patterns, and installed a persistent SSH backdoor on infected systems.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed api-rust-sdk from npm during the malicious window; credential and file exfiltration; persistent SSH backdoor access.
- Ecosystems
- Attack vectors
- Affected entities
- api-rust-sdknpm package containing malicious postinstall hook
The npm package api-rust-sdk was published with a malicious postinstall hook (node test.js) that executed three distinct attack payloads upon installation. The package name falsely suggested a Rust SDK but contained no legitimate functionality.\n\nThe first payload fetched an attacker-controlled SSH public key from http://95.216.118.146:3001/api/ssh-key, appended it to ~/.ssh/authorized_keys with mode 0600, and executed sudo ufw allow 22/tcp to ensure inbound SSH access—granting the attacker persistent remote access to the infected host.\n\nThe second payload searched the current working directory for sensitive configuration and keypair files (id.json, config.toml, Config.toml, env, .env) and exfiltrated them to http://95.216.118.146:3000/api/v1, prefixed with the installer's username. This targeted Solana keypairs and Rust/dotenv secrets.\n\nThe third payload fetched remote scan/block patterns from http://95.216.118.146:3001/api/scan-patterns, enumerated the user's home directory (Unix) or all logical drives (Windows via wmic/PowerShell), and uploaded all matching files along with username and platform metadata to http://95.216.118.146:3001/api/v1. The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- api-rust-sdk
- IPs
- 95.216.118.146
Remediation
- Immediately uninstall api-rust-sdk from all systems and CI/CD pipelines
- Audit ~/.ssh/authorized_keys on all affected hosts for unauthorized SSH keys and remove any added by the malicious package
- Rotate all Solana keypairs, API credentials, and secrets that may have been exfiltrated
- Review process logs and SSH access logs for unauthorized remote access attempts from 95.216.118.146
- Scan affected systems for files that may have been exfiltrated based on the patterns (id.json, config.toml, Config.toml, env, .env, and custom patterns)
- Block outbound connections to 95.216.118.146 at the network perimeter
- Implement npm package vetting and postinstall hook inspection in your supply chain security practices
Sources
- GitHub Advisory GHSA-4hhr-c99m-jq9f · GitHub Advisory Database
Cite this entry
"Malicious code in api-rust-sdk (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-api-rust-sdk-npm-1hba9d
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
npmCompromised package