Malicious code in ezdiscordbots (npm)
The npm package ezdiscordbots contained malicious code that executes with root privileges during installation. A postinstall script runs obfuscated JavaScript that decodes to attacker-controlled payload and installs a persistent Linux daemon via the node-linux dependency.
- Disclosed
- Last updated
- Blast radius
- Any system installing the ezdiscordbots package; attacker gains root-level code execution and persistence capability on the host machine.
- Ecosystems
- Attack vectors
- Affected entities
- ezdiscordbotsnpm package containing malicious postinstall script and obfuscated payload
The ezdiscordbots npm package was found to contain malicious code designed to execute with elevated privileges during installation. The package.json declares a postinstall script that runs sudo node install.js, executing JavaScript code with root privileges on the installer's machine.\n\nBoth install.js and index.js are heavily obfuscated using js-virtualizer and obfuscator.io techniques, including hex-mangled identifiers, control-flow flattening, and anti-debug checks. The index.js file concatenates four decoder-produced fragments and decodes them via Buffer.from(dora, 'base64').toString() at module load time, materializing executable content not visible in the shipped source code.\n\nThe package declares runtime dependencies on js-virtualizer (an obfuscator tool) and node-linux (a systemd/init daemon registration library), neither of which has any legitimate connection to a Discord bot. The node-linux dependency provides the primitives to install a persistent root-level daemon. This combination—sudo-elevated postinstall, obfuscated self-decoding payload, and a service-installer dependency—constitutes a canonical install-time remote code execution and persistence attack.\n\nInstalling this package causes attacker-controlled code to execute as root on the host system. The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- ezdiscordbots
Remediation
- Immediately uninstall the ezdiscordbots package from all systems: `npm uninstall ezdiscordbots`
- Audit systems where ezdiscordbots was installed for unauthorized root-level processes, systemd services, or daemon registrations
- Review system logs and process history for suspicious activity during and after the package installation
- If the package was installed with sudo or in a privileged context, assume full system compromise and perform forensic analysis
- Check for persistence mechanisms such as cron jobs, systemd services, or init.d scripts installed by the malicious payload
- Update npm and verify the integrity of other installed packages
- Consider using npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-5r45-5p39-9pxx · GitHub Advisory Database
Cite this entry
"Malicious code in ezdiscordbots (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 6, 2026; last updated August 6, 2026. https://supplychainattack.org/incident/malicious-code-in-ezdiscordbots-npm-1yv9gq
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in ranux-pro (npm)
The npm package ranux-pro contained malicious code disguised as a network socket library. The package shipped a multi-tenant WhatsApp bot with obfuscated code and a mutable dependency override pointing to a personal GitHub account, allowing attackers to execute arbitrary code at install and runtime.
npmCompromised packageMalicious commit