Malicious code in evm-validation (npm)
The evm-validation npm package contains malicious code that exfiltrates caller-supplied data (EVM addresses, keys, or arbitrary user data) to a remote attacker-controlled endpoint (https://api-ivalidte.vercel.app/app/api/) instead of performing local validation as advertised.
- Disclosed
- Last updated
- Blast radius
- All applications consuming the evm-validation npm package
- Ecosystems
- Attack vectors
- Affected entities
- evm-validationnpm package
The evm-validation npm package advertises EVM address validation functionality but contains malicious code that silently relays user data to a remote host. The package's single exported function validated(e) uses axios.get to send the caller-supplied argument to a hardcoded destination, transmitting whatever data the consuming application passes in—including EVM addresses, private keys, or arbitrary user data—to an attacker-controlled endpoint.\n\nThe malicious destination is deliberately obfuscated through multiple layers: a scrambled string array is joined, ROT13-transformed, and reversed at runtime to reconstruct the URL https://api-ivalidte.vercel.app/app/api/. This endpoint is hosted on Vercel and does not correspond to any documented service for the package, exhibiting a typosquat-shaped domain pattern.\n\nThe combination of obfuscated exfiltration logic, mismatch between advertised functionality (local validation) and actual behavior (remote relay), and author-controlled endpoint constitutes a silent-relay attack. Any application using this package to validate or process EVM addresses or related sensitive data has had that data transmitted to the attacker's infrastructure without the developer's knowledge or consent.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- evm-validation
- Domains
- api-ivalidte.vercel.app
Remediation
- Immediately remove the evm-validation package from all projects and dependencies
- Audit application logs and network traffic to identify what data was transmitted to https://api-ivalidte.vercel.app/app/api/
- Rotate any EVM addresses, private keys, or sensitive data that may have been processed by the package
- Replace evm-validation with a legitimate, audited EVM validation library or implement local validation logic
- Review package.json and lock files to identify all affected versions and remove them
- Notify users if their data may have been exposed through this package
Sources
- GitHub Advisory GHSA-8f2h-vv9f-2gg5 · GitHub Advisory Database
Cite this entry
"Malicious code in evm-validation (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-evm-validation-npm-1cspy9
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in testingsmthb1g (npm)
The npm package testingsmthb1g contains malicious code in its postinstall script that acts as an install-time dropper, downloading and executing a Windows binary payload and exfiltrating platform information. The attack includes sandbox escape capabilities for WSL/virtualized Linux environments.
npmCompromised package - resolvedcritical
Malicious code in mutex-core (npm)
The npm package mutex-core, published under a name resembling the popular async-mutex library, contained malicious code including a staged loader that decrypts and executes hidden payloads. The package included obfuscated code that conditionally triggers AES-256-GCM decryption and execution of encrypted binary content when specific conditions are met.
npmCompromised package - containedcritical
Malicious code in tyepescript-cli (npm)
tyepescript-cli, a typosquat of the legitimate typescript package on npm, contains malicious postinstall code that downloads and executes a Windows binary (main.exe) and beacons to an attacker-controlled server. The package uses XOR obfuscation to hide URLs, commands, and IP addresses, with special logic to target both Windows and WSL environments.
npmTyposquattingCompromised package - containedcritical
Malicious code in commandor-cli (npm)
commandor-cli@1.0.0 on npm contains malicious postinstall script that downloads and executes a binary from an attacker-controlled GitHub repository. The script also beacons installation metadata to a command-and-control server and includes a PowerShell bridge to extend execution to Windows hosts on WSL systems.
npmCompromised packageMalicious commit