Malicious code in fetchrtds (npm)
The npm package fetchrtds contained malicious code in its postinstall script that fetches and executes arbitrary Node.js code from a remote, unverified source (slimopump.vercel.app) during installation. The package's advertised functionality (Polymarket/Chainlink TWAP via RTDS WebSocket) does not match the shipped code, which only contains trivial Kelly-stake arithmetic helpers; the actual payload is delivered remotely at install time.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed fetchrtds during the malicious period.
- Ecosystems
- Attack vectors
- Affected entities
- fetchrtdsnpm package with malicious postinstall script
The npm package fetchrtds was found to contain malicious code embedded in its postinstall script. Upon installation, the script reads a configuration URL (defaulting to https://slimopump.vercel.app/config/clob-math.json) and fetches a .tgz bundle referenced by that configuration.
The fetched bundle is extracted and npm install is executed within the extracted directory, followed by a require() call to the extracted peer-math.js file and invocation of syncSession(). This allows arbitrary Node.js code chosen by the operator of slimopump.vercel.app to execute on the installer's machine at install time.
The remote bundle is unpinned and unverified—no hash or signature validation is performed—and the host is neither the package's registry nor a publisher-matched domain. The advertised purpose of the package (Polymarket/Chainlink TWAP via RTDS WebSocket) does not match the shipped code, which is limited to trivial Kelly-stake arithmetic helpers (computeKellyStake, formatStakeUsd, roundStake). The functional payload is delivered exclusively via the postinstall fetch mechanism.
This incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- fetchrtds
- Domains
- slimopump.vercel.app
Remediation
- Immediately uninstall fetchrtds from all systems where it was installed
- Audit npm install logs to identify when fetchrtds was installed and what code may have been executed
- Review system activity and network connections during and after fetchrtds installation for signs of compromise
- Rotate any credentials or secrets that may have been exposed on affected machines
- Update npm and Node.js to the latest versions
- Consider using npm audit and supply chain security tools to detect similar malicious packages
- Review and restrict postinstall script execution policies in npm configuration
Sources
- GitHub Advisory GHSA-8q4f-pw48-hvm7 · GitHub Advisory Database
Cite this entry
"Malicious code in fetchrtds (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 6, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-fetchrtds-npm-u3laxr
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - containedcritical
Malware in @siwatfa/yorn
Malware was discovered in the npm package @siwatfa/yorn. Systems with this package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different computer.
npmCompromised package - containedcritical
Malware in arc-diag-util
The npm package arc-diag-util was found to contain malware, resulting in full system compromise of any computer with the package installed or running. All secrets and keys should be rotated immediately from a different machine, and the package should be removed.
npmCompromised package - activecritical
Malware in club-sauce
Malware discovered in the npm package club-sauce. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package