Malicious code in app-sima-layer (npm)
The npm package app-sima-layer contained malicious code in its postinstall script that performed coordinated attacks: installing SSH backdoors on Linux, stealing wallet and configuration files, and harvesting files matching attacker-controlled patterns from the host system.
- Disclosed
- Last updated
- Blast radius
- Any developer or system installing the malicious app-sima-layer package from npm; affects Linux and Windows systems with potential for persistent remote access, credential theft, and file exfiltration.
- Ecosystems
- Attack vectors
- Affected entities
- app-sima-layernpm package containing malicious postinstall script
The npm package app-sima-layer was found to contain malicious code executed during installation via a postinstall script. The script performed three coordinated attack phases targeting the installer's system.\n\nOn Linux systems, the script fetched an SSH public key from http://95.216.118.146:3001/api/ssh-key and appended it to ~/.ssh/authorized_keys, then executed sudo ufw enable and sudo ufw allow 22/tcp to enable inbound SSH access, granting the attacker persistent remote shell access to the compromised host.\n\nThe script also recursively searched the current working directory for sensitive files (id.json, config.toml, Config.toml, env, .env) matching Solana keypair wallets, application configs, and environment secrets, then exfiltrated them via POST to http://95.216.118.146:3000/api/v1. Additionally, it fetched attacker-controlled file scan and block patterns from http://95.216.118.146:3001/api/scan-patterns and /api/block-patterns, then walked the user's home directory (Unix) or all logical drives (Windows via wmic/PowerShell) to collect and exfiltrate matching files with metadata to http://95.216.118.146:3001/api/v1.\n\nThe remote pattern feed allowed the attacker to retarget file harvesting without republishing the package. The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- IPs
- 95.216.118.146
Remediation
- Immediately uninstall app-sima-layer from all systems
- Audit ~/.ssh/authorized_keys on all Linux systems for unauthorized SSH keys and remove any entries added by the package
- Review firewall rules (ufw) on Linux systems and disable any rules allowing inbound SSH that were added by the package
- Rotate all Solana keypair wallets and credentials that may have been exposed
- Scan systems for exfiltrated files and review access logs for unauthorized SSH connections from 95.216.118.146
- Check npm audit and dependency trees for any direct or transitive dependencies on app-sima-layer
- Monitor network traffic for connections to 95.216.118.146 on ports 3000 and 3001
Sources
- GitHub Advisory GHSA-gxmw-r885-6v87 · GitHub Advisory Database
Cite this entry
"Malicious code in app-sima-layer (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-app-sima-layer-npm-tf528u
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
npmCompromised package