Malicious code in cheerio-tool (npm)
cheerio-tool, a typosquatting package on npm impersonating the popular cheerio HTML parser, contained malicious postinstall code that harvested npm credentials, API keys, cloud credentials, and cryptocurrency wallet data from infected systems.
- Disclosed
- Last updated
- Blast radius
- Any npm user who installed cheerio-tool; credential and wallet data exfiltration risk for affected systems
- Ecosystems
- Attack vectors
- Affected entities
- cheerio-toolTyposquatting package impersonating cheerio HTML parser
cheerio-tool is a typosquatting package on npm designed to impersonate the legitimate cheerio HTML parser library. The package's README falsely claims to provide 'Cheerio Tool utility helpers' and uses keywords like 'lodash' and 'utilities' to increase discoverability, while its index.js self-describes as a 'dummy module' with the real payload in postinstall.js.\n\nUpon installation via npm install, the declared postinstall script executes a credential harvester and cryptocurrency wallet scanner. The malware reads sensitive files including ~/.npmrc, ~/.env, and ~/.git-credentials, extracting npm authentication tokens, API keys, database URLs, AWS/GCP cloud credentials, payment keys, and webhook secrets.\n\nThe malware also enumerates browser profile directories across Chrome, Brave, Edge, Chromium, Vivaldi, and Opera, scanning Local Extension Settings against 71 hardcoded cryptocurrency wallet extension IDs (including MetaMask, Phantom, Coinbase, Trust, Ledger, and Trezor). It regex-matches vault, mnemonic, seed phrase, private key, and encrypted-blob material from LevelDB .log files. Additionally, it scans ~/Documents, ~/Desktop, and ~/Downloads for files matching wallet-related patterns and validates contents against BIP-39 wordlists.\n\nCollected data is bundled with hostname and username and exfiltrated via HTTP POST to a hardcoded command-and-control server at http://149.28.127.35:8888 (plain HTTP, bare IPv4 address, overridable via C2_URL environment variable).
Indicators of compromise
- Packages
- cheerio-tool
- IPs
- 149.28.127.35
Remediation
- Immediately uninstall cheerio-tool from all systems and projects
- Rotate all npm authentication tokens and API keys that may have been exposed
- Reset AWS/GCP cloud credentials and review access logs for unauthorized activity
- Change passwords for any accounts with credentials stored in ~/.env or ~/.git-credentials
- Scan cryptocurrency wallets (MetaMask, Phantom, Coinbase, Trust, Ledger, Trezor, etc.) for unauthorized transactions and consider moving funds if compromise is suspected
- Review npm package.json and lock files to ensure cheerio-tool is not listed as a dependency
- Audit browser extensions and remove any suspicious or unfamiliar wallet extensions
- Monitor the C2 IP address (149.28.127.35) for any outbound connections from affected systems
- Use the legitimate cheerio package instead of cheerio-tool
Sources
- GitHub Advisory GHSA-34x4-g9xm-gjmw · GitHub Advisory Database
Cite this entry
"Malicious code in cheerio-tool (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-cheerio-tool-npm-cii896
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting - containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package - containedcritical
Malicious code in typography-stylecss (npm)
The npm package typography-stylecss is a typosquatting attack impersonating the legitimate @tailwindcss/typography plugin. It contains obfuscated malicious code that downloads and executes a platform-specific binary when the module is imported, triggered automatically during Tailwind config loading.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package