Malicious code in config-helper-kit (npm)
config-helper-kit@1.3.2 (npm) contains malicious code that fetches and executes arbitrary JavaScript from a remote IP address (31.97.137.157:45000), granting remote code execution to any consumer that invokes the package's default export.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that imports and invokes the default export of config-helper-kit@1.3.2
- Ecosystems
- Attack vectors
- Affected entities
- config-helper-kit · 1.3.2
config-helper-kit@1.3.2 on npm contains a malicious default export function getPlugin that performs an undocumented HTTPS request to a hardcoded bare-IP host at https://31.97.137.157:45000/icons/109. The response data's credits field is passed into new Function('require','module',...), executing attacker-controlled JavaScript with full Node.js capabilities including require and module access.\n\nThe package is advertised in its README as a TypeScript/Tailwind configuration helper, but the remote-code-fetch-and-execute behavior is completely undocumented and unrelated to that stated purpose. The code includes an unused helper that references legitimate CDN hostnames (Cloudflare, Fastly, Akamai, cdnjs) alongside icon/logo/credits naming, creating a false appearance of legitimacy while the actual network target is a bare IP address unrelated to any CDN.\n\nAny application that imports and invokes the default export of this package grants the operator of 31.97.137.157:45000 arbitrary code execution in the Node.js process with full access to the host system. The malicious package was identified by the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- config-helper-kit@1.3.2
- IPs
- 31.97.137.157
Remediation
- Remove config-helper-kit@1.3.2 from all dependencies immediately
- Audit all Node.js processes that may have installed or executed this package version
- Review application logs and system activity for signs of unauthorized code execution during the period the malicious package was installed
- Update to a patched version of config-helper-kit if available, or replace with a legitimate alternative
- Implement package integrity verification and supply chain security scanning in your build pipeline
Sources
- GitHub Advisory GHSA-4hc5-4fm3-mm56 · GitHub Advisory Database
Cite this entry
"Malicious code in config-helper-kit (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-config-helper-kit-npm-10wgre
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package