Malicious code in gaarf-node (npm)
The npm package gaarf-node contained malicious code that executed a postinstall script to collect and exfiltrate host identifiers to a remote server. The package impersonated Google's legitimate gaarf project and was labeled as a "Security research canary" in its metadata.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed gaarf-node
- Ecosystems
- Attack vectors
- Affected entities
- gaarf-nodeMalicious npm package impersonating Google's gaarf (ads-api-report-fetcher) project
The npm package gaarf-node was published with embedded malicious code designed to execute automatically during installation. The postinstall script collected sensitive host information including hostname, platform, architecture, Node.js version, package name, and npm lifecycle event details.
This data was exfiltrated via HTTP POST requests to a hardcoded remote host at ze0buq23.instances.poc.jchunt.top/gaarf-node without user consent. The package name and metadata were crafted to impersonate Google's legitimate ads-api-report-fetcher (gaarf) project, a typosquatting technique to increase installation likelihood.
The package self-identified as a "Security research canary" in package.json, suggesting it may have been intentionally published for research or testing purposes. The destination domain is unrelated to the legitimate Google project, confirming malicious intent.
The incident was identified and reported through the OpenSSF's malicious-packages repository (MAL-2026-14238), enabling rapid detection and containment.
Indicators of compromise
- Packages
- gaarf-node
- Domains
- ze0buq23.instances.poc.jchunt.top
Remediation
- Remove gaarf-node from all npm installations immediately
- Audit npm install logs to identify affected systems and installation timestamps
- Assume host identifiers (hostname, platform, architecture, Node version) may have been compromised and exposed
- Use the legitimate gaarf package from Google (ads-api-report-fetcher) if the functionality is required
- Review npm audit and lock files for any other suspicious packages
- Monitor outbound connections to ze0buq23.instances.poc.jchunt.top for evidence of data exfiltration
- Implement npm package verification and allowlisting policies to prevent installation of typosquatted packages
Sources
- GitHub Advisory GHSA-x44c-6j8r-28px · GitHub Advisory Database
Cite this entry
"Malicious code in gaarf-node (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-gaarf-node-npm-1arovc
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package