Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
- Disclosed
- Last updated
- Blast radius
- Any developer who installed create-coin@20.1.1 via npm install
- Ecosystems
- Attack vectors
- Affected entities
- create-coin · 20.1.1
The npm package create-coin@20.1.1 contained malicious code in a postinstall hook (build/payload.node.js) that executed during npm install. The script implemented anti-analysis guards to avoid detection in CI/GitHub Actions environments and containers, then collected sensitive data including npm credentials from ~/.npmrc, environment variables, project configuration files (package.json, package-lock.json, .env, src/config.*), and host reconnaissance via hostname, user info, and system commands.
All collected data was exfiltrated via HTTPS POST to a hardcoded endpoint (https://random-name.trycloudflare.com) with certificate validation disabled. The package used a lock file mechanism to ensure the payload ran only once per installation. Error handling was designed to mask the malicious activity, forcing a successful exit code so npm install appeared to complete normally.
The package.json falsely claimed the package was a "netbsd-x64 build for esbuild," indicating a typosquatting or platform-package impersonation attack targeting developers seeking esbuild platform-specific builds. The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- create-coin
- Domains
- random-name.trycloudflare.com
Remediation
- Immediately uninstall create-coin from all systems where it was installed
- Rotate all npm credentials and tokens, particularly those stored in ~/.npmrc
- Review and rotate any credentials or secrets that may have been exposed in environment variables or configuration files
- Audit environment variables and .env files for any sensitive data that may have been exfiltrated
- Check npm audit logs and package-lock.json for unexpected dependencies or versions
- Monitor outbound network traffic to the exfiltration endpoint for evidence of data transmission
- Update npm to the latest version and run npm audit to detect other malicious packages
Sources
- GitHub Advisory GHSA-468x-vgxv-xv9w · GitHub Advisory Database
Cite this entry
"Malicious code in create-coin (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 23, 2026; last updated August 23, 2026. https://supplychainattack.org/incident/malicious-code-in-create-coin-npm-1wb3km
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package - containedcritical
Malicious code in chai-as-gateway (npm)
The npm package chai-as-gateway contained malicious code that executes automatically on installation. The package masquerades as a logger (copying documentation from pino) but includes an obfuscated blob that harvests AWS credentials and other sensitive files from the home directory and exfiltrates them via HTTP.
npmCompromised packageTyposquatting