Malicious code in @dexwilt/node-fetch (npm)
The @dexwilt/node-fetch npm package is a typosquatting attack impersonating the legitimate node-fetch project. Its CommonJS entry point contains obfuscated malicious code that downloads and executes a remote binary payload.
- Disclosed
- Last updated
- Blast radius
- Any developer or application that installed @dexwilt/node-fetch
- Ecosystems
- Attack vectors
- Affected entities
- @dexwilt/node-fetchMalicious npm package impersonating legitimate node-fetch
The @dexwilt/node-fetch package on npm is a malicious package that impersonates the legitimate node-fetch project by copying its package metadata, upstream repository, author, and homepage information while publishing under an unrelated scope.
The package's CommonJS entry point (lib/index.js) contains the expected node-fetch implementation followed by approximately 94 KB of RC4/Base64-obfuscated code. The ESM builds do not contain this payload. Deobfuscation revealed a cross-platform download and execution chain that retrieves a remote binary from an encrypted endpoint, verifies its SHA-256 hash, and executes it with detached, hidden-window, and ignored-stdio options.
Loading the package's declared main entry point triggers execution of the concealed remote payload loader embedded after the legitimate node-fetch code. The obfuscated source exposes fields including detached, windowsHide, stdio, environment, working-directory, size, SHA-256, and download timestamp used by the malicious chain.
This incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @dexwilt/node-fetch
Remediation
- Immediately uninstall @dexwilt/node-fetch from all projects and dependencies
- Audit npm install logs and lock files to identify when the package was installed
- Assume any system that installed this package may be compromised; conduct forensic analysis for signs of remote binary execution
- Use the legitimate node-fetch package (https://www.npmjs.com/package/node-fetch) instead
- Review npm package names carefully before installation to avoid typosquatting attacks
- Consider using npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-xqj6-r3qp-9rx9 · GitHub Advisory Database
Cite this entry
"Malicious code in @dexwilt/node-fetch (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 31, 2026; last updated July 31, 2026. https://supplychainattack.org/incident/malicious-code-in-dexwilt-node-fetch-npm-9vdsfa
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @coralxyz/anchor (npm)
The npm package @coralxyz/anchor is a typosquatting attack impersonating the legitimate @coral-xyz/anchor Solana framework. It contains a postinstall hook that downloads and executes a malicious executable on Windows systems. The package provides no legitimate functionality and serves solely as a dropper for malware.
npmTyposquattingCompromised package - containedcritical
Malicious code in @nestjs-passport/jwt (npm)
A malicious npm package @nestjs-passport/jwt was published under a scope resembling official NestJS packages. The package contains JSFuck-encoded obfuscated code (~2.3MB) that executes hidden functionality at require/import time in the installer's Node process.
npmTyposquattingCompromised package - containedcritical
Malicious code in dolyame-ui-datatable (npm)
The npm package dolyame-ui-datatable contains malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure. The package is a typosquat/dependency-confusion carrier with no legitimate UI or datatable functionality, only loader and dropper code.
npmCompromised packageTyposquatting - activecritical
Malicious code in hardhat-set (npm)
The npm package hardhat-set contains malicious obfuscated code disguised with a copied pino logger README. The package executes a multi-megabyte obfuscated payload on import, delivering hidden malware to anyone who installs or requires it.
npmTyposquattingCompromised package