Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in @dexwilt/node-fetch (npm)

The @dexwilt/node-fetch npm package is a typosquatting attack impersonating the legitimate node-fetch project. Its CommonJS entry point contains obfuscated malicious code that downloads and executes a remote binary payload.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or application that installed @dexwilt/node-fetch
Ecosystems
npm
Attack vectors
Compromised packageTyposquatting
Affected entities
  • @dexwilt/node-fetchMalicious npm package impersonating legitimate node-fetch

The @dexwilt/node-fetch package on npm is a malicious package that impersonates the legitimate node-fetch project by copying its package metadata, upstream repository, author, and homepage information while publishing under an unrelated scope.

The package's CommonJS entry point (lib/index.js) contains the expected node-fetch implementation followed by approximately 94 KB of RC4/Base64-obfuscated code. The ESM builds do not contain this payload. Deobfuscation revealed a cross-platform download and execution chain that retrieves a remote binary from an encrypted endpoint, verifies its SHA-256 hash, and executes it with detached, hidden-window, and ignored-stdio options.

Loading the package's declared main entry point triggers execution of the concealed remote payload loader embedded after the legitimate node-fetch code. The obfuscated source exposes fields including detached, windowsHide, stdio, environment, working-directory, size, SHA-256, and download timestamp used by the malicious chain.

This incident was identified and credited to the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • @dexwilt/node-fetch

Remediation

  • Immediately uninstall @dexwilt/node-fetch from all projects and dependencies
  • Audit npm install logs and lock files to identify when the package was installed
  • Assume any system that installed this package may be compromised; conduct forensic analysis for signs of remote binary execution
  • Use the legitimate node-fetch package (https://www.npmjs.com/package/node-fetch) instead
  • Review npm package names carefully before installation to avoid typosquatting attacks
  • Consider using npm audit and supply chain security tools to detect similar malicious packages

Sources

  1. GitHub Advisory GHSA-xqj6-r3qp-9rx9 · GitHub Advisory Database

Cite this entry

"Malicious code in @dexwilt/node-fetch (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 31, 2026; last updated July 31, 2026. https://supplychainattack.org/incident/malicious-code-in-dexwilt-node-fetch-npm-9vdsfa

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in redis-type-xyz (npm)

    redis-type-xyz is a malicious npm package that impersonates Redis OM by copying its metadata while substituting a known-malicious ulid-xyz dependency. Installation triggers a postinstall hook that establishes C2 communication and enables system compromise including persistence and arbitrary code execution.

    npmCompromised packageTyposquattingDependency confusion
  2. containedcritical

    Malicious code in sigchain-js (npm)

    Malicious code was injected into the published npm package sigchain-js, executing arbitrary code on installation via DES-decrypted payloads from companion packages thedata and tchain-api. The attack also involved typosquatting axios to version 1.18.1, which does not exist in legitimate release history.

    npmCompromised packageDependency confusionTyposquatting
  3. resolvedcritical

    Malicious code in rollup-runtime-core-polyfills (npm)

    The npm package rollup-runtime-core-polyfills contained malicious code that impersonated a legitimate rollup polyfill plugin. On every import/require, it decoded and executed a shell command to install an attacker-controlled package (svgcraft-core) and executed code from it, affecting any build system that consumed this package.

    npmCompromised packageTyposquatting
  4. containedcritical

    Malicious code in text-line-parser (npm)

    The npm package text-line-parser contained malicious code in its postinstall.js that collected system information, environment variables (including CI tokens and cloud credentials), and exfiltrated them to a Burp Collaborator domain. The package advertised itself as a text-parsing utility but shipped only stub functions, consistent with a typosquat/decoy supply-chain attack.

    npmCompromised packageTyposquatting