Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in glob-helper (npm)

glob-helper@1.0.2 is a malicious typosquat package that executes a postinstall script to steal npm tokens, AWS credentials, GitHub tokens, and cryptocurrency wallet data from developer machines. The stolen data is exfiltrated to a hardcoded C2 server at http://149.28.127.35:8888 over plain HTTP.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer who installed glob-helper@1.0.2 had credentials and crypto-wallet data exfiltrated during installation.
Ecosystems
npm
Attack vectors
TyposquattingCompromised package
Affected entities
  • glob-helper · 1.0.2

glob-helper@1.0.2 is a typosquat package published to npm with no legitimate functionality. The package.json declares a postinstall script that executes automatically upon installation, triggering credential-theft operations.

The malicious postinstall.js performs three concurrent data-exfiltration operations:

  1. Credential harvesting: Reads ~/.npmrc (extracting authToken and npm* tokens), ~/.env (regex-matching NPM_TOKEN, NPM_AUTH_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN), and ~/.git-credentials.

  2. Crypto-wallet targeting: Enumerates browser profile directories (Chrome, Brave, Edge, Chromium, Vivaldi, Opera) under ~/.config/*, searches Local Extension Settings for 71 hardcoded cryptocurrency wallet extension IDs (including MetaMask, Phantom, Coinbase, Trust, Ledger Live, Trezor), and greps log contents for keywords like vault, seed, mnemonic, privateKey, password, encrypted.

  3. Wallet file scanning: Walks ~/Documents, ~/Desktop, ~/Downloads for files matching patterns like seed|backup|wallet|phrase|metamask|phantom|vault|key|private, counts BIP39 wordlist matches, and includes file paths and content previews in the exfiltration payload when 8+ BIP39 words are detected.

All stolen data is POSTed as JSON over plain HTTP to http://149.28.127.35:8888. The package masquerades as a "Glob Helper utility" with keywords including lodash to evade detection.

Indicators of compromise

Packages
  • glob-helper
IPs
  • 149.28.127.35

Remediation

  • Immediately uninstall glob-helper from all systems: npm uninstall glob-helper
  • Rotate all npm tokens, AWS credentials, and GitHub tokens that may have been exposed
  • Review ~/.npmrc, ~/.env, and ~/.git-credentials for unauthorized access or token changes
  • Scan browser extension settings and local storage for unauthorized access to cryptocurrency wallets
  • Check ~/Documents, ~/Desktop, ~/Downloads for unauthorized file access or modifications
  • Review network logs for outbound connections to 149.28.127.35:8888 or other suspicious IPs
  • Consider the compromise of any cryptocurrency wallets accessible from affected machines
  • Audit npm package.json dependencies for other typosquat or malicious packages

Sources

  1. GitHub Advisory GHSA-5f9h-7gp2-hg2m · GitHub Advisory Database

Cite this entry

"Malicious code in glob-helper (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-glob-helper-npm-1dd6nc

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in prettier-lint-lenz (npm)

    The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.

    npmCompromised packageTyposquatting
  2. containedcritical

    Malicious code in hardhat-core (npm)

    The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.

    npmTyposquattingCompromised package
  3. containedcritical

    Malicious code in typography-stylecss (npm)

    The npm package typography-stylecss is a typosquatting attack impersonating the legitimate @tailwindcss/typography plugin. It contains obfuscated malicious code that downloads and executes a platform-specific binary when the module is imported, triggered automatically during Tailwind config loading.

    npmTyposquattingCompromised package
  4. containedcritical

    Malicious code in prisma-callback (npm)

    prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.

    npmTyposquattingCompromised package