Malicious code in ethereum-vault-connector (npm)
A malicious npm package named ethereum-vault-connector impersonated Euler Labs' legitimate Ethereum Vault Connector project and distributed a Node.js credential stealer. The package automatically executed on install via preinstall and postinstall hooks, exfiltrating environment variables, SSH keys, AWS credentials, and other sensitive files to an external webhook.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed the malicious ethereum-vault-connector package during the active distribution window.
- Ecosystems
- Attack vectors
- Affected entities
- ethereum-vault-connectorMalicious npm package impersonating Euler Labs' Ethereum Vault Connector Solidity project
A malicious npm package named ethereum-vault-connector was published to impersonate Euler Labs' legitimate Ethereum Vault Connector Solidity project. Instead of the expected Solidity code, the package contained a Node.js credential stealer as its index.js entry point.
Upon installation, the malicious script executed automatically via npm lifecycle hooks (preinstall and postinstall). It scanned the environment for sensitive variables matching patterns like KEY, TOKEN, SECRET, PASS, PRIVATE, MNEMONIC, AWS, GITHUB, NPM, and WALLET. The script also read standard credential files including ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, Solana/Sui/Anchor keys, and others.
Collected credentials were exfiltrated via a detached child process that slept 60-240 seconds before POSTing the data to https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09. The script included sandbox-evasion logic, refusing to execute when it detected scan/detonation environments, honeypot markers, or known npm registry mirrors, confirming malicious intent.
The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- ethereum-vault-connector
- Domains
- webhook.site
Remediation
- Immediately uninstall ethereum-vault-connector from all systems and CI/CD pipelines.
- Rotate all credentials (AWS keys, SSH keys, GitHub tokens, NPM tokens, wallet keys, etc.) that may have been exposed during the installation window.
- Audit npm package.json and lock files for any unexpected or suspicious dependencies.
- Review npm audit logs and CI/CD build logs for evidence of the malicious package installation.
- Implement npm package verification and allowlisting policies to prevent installation of typosquatted or impersonated packages.
- Monitor for any unauthorized access to AWS, GitHub, Docker, Kubernetes, or other services using the exfiltrated credentials.
- Use npm's --ignore-scripts flag or disable lifecycle hooks for untrusted packages during installation.
Sources
- GitHub Advisory GHSA-4c5m-f9mr-jxrp · GitHub Advisory Database
Cite this entry
"Malicious code in ethereum-vault-connector (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 11, 2026. https://supplychainattack.org/incident/malicious-code-in-ethereum-vault-connector-npm-bvt64i
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in crypto-javas (npm)
The npm package crypto-javas contains malicious code in its postinstall hook and main entrypoint that harvests environment variables (including CI secrets like AWS_*, GITHUB_TOKEN, NPM_TOKEN) and exfiltrates them to an attacker-controlled backend. The package is presented deceptively as @wizlabs/js-crypto with a placeholder repository.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in react-dom-helpers (npm)
The npm package react-dom-helpers, a typosquat of the legitimate react-dom, contained malicious code that exfiltrated host identifiers (local IPv4 addresses, public IP, and system information) to a hardcoded Slack webhook on module load.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in localize-extract (npm)
localize-extract@1.0.0 on npm contained malicious postinstall code that exfiltrated host identifiers to an attacker-controlled endpoint. The package name resembled @angular/localize, suggesting a dependency-confusion or typosquatting attack.
npmCompromised packageTyposquattingDependency confusion - containedcritical
Malicious code in postcss-initialize-provider (npm)
postcss-initialize-provider@3.0.4 on npm contains malicious obfuscated code that typosquats the legitimate postcss-initial package. The payload captures require and module globals, queries Ethereum RPC endpoints for attacker-controlled data, and executes it via child_process.
npmCompromised packageTyposquatting