Malicious code in app-sima-layer (npm)
The npm package app-sima-layer contained malicious code in its postinstall script that performed coordinated attacks: installing SSH backdoors on Linux, stealing wallet and configuration files, and harvesting files matching attacker-controlled patterns from the host system.
- Disclosed
- Last updated
- Blast radius
- Any developer or system installing the malicious app-sima-layer package from npm; affects Linux and Windows systems with potential for persistent remote access, credential theft, and file exfiltration.
- Ecosystems
- Attack vectors
- Affected entities
- app-sima-layernpm package containing malicious postinstall script
The npm package app-sima-layer was found to contain malicious code executed during installation via a postinstall script. The script performed three coordinated attack phases targeting the installer's system.\n\nOn Linux systems, the script fetched an SSH public key from http://95.216.118.146:3001/api/ssh-key and appended it to ~/.ssh/authorized_keys, then executed sudo ufw enable and sudo ufw allow 22/tcp to enable inbound SSH access, granting the attacker persistent remote shell access to the compromised host.\n\nThe script also recursively searched the current working directory for sensitive files (id.json, config.toml, Config.toml, env, .env) matching Solana keypair wallets, application configs, and environment secrets, then exfiltrated them via POST to http://95.216.118.146:3000/api/v1. Additionally, it fetched attacker-controlled file scan and block patterns from http://95.216.118.146:3001/api/scan-patterns and /api/block-patterns, then walked the user's home directory (Unix) or all logical drives (Windows via wmic/PowerShell) to collect and exfiltrate matching files with metadata to http://95.216.118.146:3001/api/v1.\n\nThe remote pattern feed allowed the attacker to retarget file harvesting without republishing the package. The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- IPs
- 95.216.118.146
Remediation
- Immediately uninstall app-sima-layer from all systems
- Audit ~/.ssh/authorized_keys on all Linux systems for unauthorized SSH keys and remove any entries added by the package
- Review firewall rules (ufw) on Linux systems and disable any rules allowing inbound SSH that were added by the package
- Rotate all Solana keypair wallets and credentials that may have been exposed
- Scan systems for exfiltrated files and review access logs for unauthorized SSH connections from 95.216.118.146
- Check npm audit and dependency trees for any direct or transitive dependencies on app-sima-layer
- Monitor network traffic for connections to 95.216.118.146 on ports 3000 and 3001
Sources
- GitHub Advisory GHSA-gxmw-r885-6v87 · GitHub Advisory Database
Cite this entry
"Malicious code in app-sima-layer (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-app-sima-layer-npm-tf528u
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in sme-rko-finance-front-operations-feed-models (npm)
The npm package sme-rko-finance-front-operations-feed-models contained malicious code that downloads and executes attacker-controlled native binaries from remote servers upon package load. The malware uses obfuscation techniques including fragmented string arrays, platform-specific endpoints, and DNS TXT record fallbacks to evade detection.
npmCompromised package - resolvedcritical
Malicious code in modern-localization (npm)
The npm package modern-localization contained malicious code that fetches and executes arbitrary JavaScript from a remote jsonbin.io endpoint on server-side require, with no integrity verification. The payload is executed with full Node.js privileges via Function() or child_process.fork().
npmCompromised package - resolvedcritical
Malicious code in sme-rko-finance-front-operations-tax (npm)
The npm package sme-rko-finance-front-operations-tax contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure on require. The package was identified and reported by OpenSSF's malicious-packages project.
npmCompromised package - resolvedcritical
Malicious code in localization-fixer (npm)
The npm package localization-fixer contained malicious code that fetches and executes arbitrary JavaScript from attacker-controlled jsonbin.io endpoints on package require, granting full Node.js capabilities to remote payloads.
npmCompromised package