Malicious code in envpack-conf (npm)
envpack-conf 1.0.1 on npm is a trojanized package impersonating pkg-conf that executes malicious code on import. The package queries Ethereum RPC endpoints for attacker-controlled instructions and downloads and executes a second-stage payload from remote hosts.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed envpack-conf 1.0.1 from npm.
- Ecosystems
- Attack vectors
- Affected entities
- envpack-conf · 1.0.1
envpack-conf 1.0.1 is a malicious npm package that impersonates the legitimate pkg-conf utility maintained by Sindre Sorhus. The package name and README use the typosquat "devpack-conf" and the author field lists "Sinde Sorus" to evade detection.
When imported, the module executes a top-level async IIFE that queries public Ethereum RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for transactions from the attacker address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a. The to field of those transactions is decoded into two IPv4 addresses.
The malware then fetches an XOR-encrypted second-stage payload from those hosts at the path /0x/cls and executes it using both eval() and spawn('node',['-e',],{detached:true,stdio:'ignore'}).unref(), creating a detached child process. All sensitive identifiers (module names, hostnames, HTTP methods, header names, the attacker address, RPC URLs, request paths, and global variable names) are written as \uXXXX-escaped Unicode literals to evade static analysis.
The legitimate pkg-conf source code is preserved above the injected malicious block as cover.
Indicators of compromise
- Packages
- envpack-conf@1.0.1
- Domains
- eth.blockscout.com
- 1rpc.io
- eth.drpc.org
- ethereum-rpc.publicnode.com
- eth-mainnet.public.blastapi.io
Remediation
- Immediately uninstall envpack-conf from all systems and projects
- Audit npm package.json files and lock files for any dependency on envpack-conf
- Review system logs and network traffic from any host that installed envpack-conf 1.0.1 for signs of second-stage payload execution
- Use the legitimate pkg-conf package from Sindre Sorhus instead
- Implement npm package verification and scanning in your CI/CD pipeline to detect typosquatting and malicious packages
Sources
- GitHub Advisory GHSA-fw27-f4gv-qw69 · GitHub Advisory Database
Cite this entry
"Malicious code in envpack-conf (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-envpack-conf-npm-cijdzd
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package