Malicious code in gear-composer (npm)
The npm package gear-composer contained malicious code implementing a credential-harvesting and exfiltration pipeline. The package included postinstall lifecycle hooks, secret-scanning functionality, and hardcoded relay destinations to Discord and HuggingFace to exfiltrate collected credentials and sensitive data.
- Disclosed
- Last updated
- Blast radius
- All npm installations of affected gear-composer versions
- Ecosystems
- Attack vectors
- Affected entities
- gear-composernpm package
The npm package gear-composer was found to contain malicious code designed to harvest and exfiltrate credentials and sensitive information from affected systems. The malicious payload was identified through analysis of multiple components within the package.
The attack chain begins with a postinstall lifecycle hook (scripts/postinstall-agent.mjs) that executes automatically during package installation, performing host identification and initiating outbound network activity. The package includes secret-scanning functionality (dist/secretScan/contentScanner.js and dist/secretScan/agentStartupAudit.js) that reads filesystem content, encodes it via base64, and sends it to HuggingFace endpoints.
Additional exfiltration channels are implemented through Discord relay components (dist/discord/discordRelayUpload.js) that handle base64-encoded data and POST requests to upload collected information. The package also embeds a relay server (dist/relay/relayServer.js) with beaconing capabilities and hardcoded credential handling (dist/hf/hfCredentials.js) that decodes base64-obfuscated credentials at load time.
The malicious configuration and credentials are hidden using an encode/decode pair (scripts/encode-deployment.mjs and dist/core/deploymentDefaults.js), indicating deliberate obfuscation to evade detection. This combination of postinstall execution, content scanning, and multi-channel exfiltration to third-party services represents a sophisticated credential-harvesting and covert-relay attack pattern.
Indicators of compromise
- Packages
- gear-composer
- Domains
- huggingface.co
- discord.com
Remediation
- Immediately uninstall gear-composer from all affected systems
- Audit npm package.json and lock files for any installations of gear-composer
- Rotate all credentials and secrets that may have been exposed on affected systems
- Review outbound network connections and logs for suspicious activity to Discord and HuggingFace endpoints
- Scan systems for any persistence mechanisms or additional malicious artifacts left by the postinstall hook
- Update to a patched version of gear-composer if available, or use an alternative package
- Monitor for unauthorized access to accounts and services that may have been compromised
Sources
- GitHub Advisory GHSA-xm56-8qhp-qv69 · GitHub Advisory Database
Cite this entry
"Malicious code in gear-composer (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-gear-composer-npm-11ed4u
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in crypto-javas (npm)
The npm package crypto-javas contains malicious code in its postinstall hook and main entrypoint that harvests environment variables (including CI secrets like AWS_*, GITHUB_TOKEN, NPM_TOKEN) and exfiltrates them to an attacker-controlled backend. The package is presented deceptively as @wizlabs/js-crypto with a placeholder repository.
npmCompromised packageTyposquatting - containedcritical
Malicious code in flydev (npm)
The npm package flydev contains malicious code designed to destroy Windows systems. The package masquerades as a utility but executes destructive operations including filesystem deletion, process termination, memory exhaustion, and fork bombs when invoked.
npmCompromised package - resolvedcritical
Malicious code in ranux-dev (npm)
ranux-dev, an npm package, contained malicious code that substituted a popular WhatsApp library dependency with arbitrary code from an unaffiliated GitHub account. The package was heavily obfuscated and designed to harvest WhatsApp sessions and credentials from installers.
npmCompromised packageDependency confusion - containedcritical
Malicious code in npm-wold (npm)
npm-wold@1.1.1 contains malicious code in its postinstall script that fetches remote JSON from a hardcoded endpoint and dynamically invokes attacker-controlled functions with attacker-supplied arguments, enabling code execution at install time.
npmCompromised package