Malicious code in crypto-javas (npm)
The npm package crypto-javas contains malicious code in its postinstall hook and main entrypoint that harvests environment variables (including CI secrets like AWS_*, GITHUB_TOKEN, NPM_TOKEN) and exfiltrates them to an attacker-controlled backend. The package is presented deceptively as @wizlabs/js-crypto with a placeholder repository.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer installing crypto-javas, particularly in CI/CD environments where secrets are exposed in environment variables.
- Ecosystems
- Attack vectors
- Affected entities
- crypto-javasnpm package with malicious postinstall hook and module-level code exfiltration
The npm package crypto-javas contains embedded malicious code designed to exfiltrate sensitive environment variables and CI/CD secrets. The postinstall hook executes setup.js, which enumerates all environment variables (except a minimal OS blocklist for PATH, HOME, USER, SHELL, LANG) and collects them alongside CI metadata (CI_JOB_ID, GITHUB_RUN_ID, project, commit, branch, hostname). This payload is then HTTPS-POSTed to a backend URL and API key specified via BACKEND_URL/BACKEND_API_KEY environment variables, package.json configuration, .crypto-config.json, or .env files.\n\nThe malicious behavior is further embedded in the declared main entrypoint index.js, which invokes autoExecute() at module load time. This instantiates SecretsHandler.readFromEnvironment and sendToBackend, ensuring that every require/import of the package re-triggers the environment-variable harvest and exfiltration. In CI/CD runners, this exposes AWS credentials, GitHub tokens, NPM tokens, CI job tokens, and any other pipeline secrets to the attacker's backend.\n\nThe package is presented deceptively: the README references @wizlabs/js-crypto (a typosquat-style mismatch with the actual package name crypto-javas), the repository is a placeholder (gitlab.com/example/js-crypto), and the author is a generic DevSecOps handle. This obfuscation suggests intentional deception to evade detection.\n\nThe incident was identified by the OpenSSF malicious-packages project and assigned identifier MAL-2026-12359.
Indicators of compromise
- Packages
- crypto-javas
Remediation
- Immediately remove crypto-javas from all projects and dependencies.
- Audit npm install logs and CI/CD pipeline execution logs to identify when the package was installed and what secrets may have been exposed.
- Rotate all potentially exposed secrets including AWS credentials, GitHub tokens, NPM tokens, and CI job tokens.
- Review and restrict environment variable access in CI/CD pipelines to only necessary variables.
- Implement package integrity checks and use npm audit to detect malicious packages.
- Consider using npm package allowlists or private registries to control package sources.
- Monitor for any unauthorized access to accounts or resources using the exposed credentials.
Sources
- GitHub Advisory GHSA-7rjh-8h63-ph2q · GitHub Advisory Database
Cite this entry
"Malicious code in crypto-javas (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-crypto-javas-npm-8goc6i
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package