Malicious code in helmet-pro (npm)
helmet-pro@10.0.4 is a typosquat of the legitimate helmet package that executes malicious code during npm install via a postinstall hook. The malicious code fetches and executes arbitrary JavaScript from a remote attacker-controlled endpoint, enabling remote code execution on the installer's machine.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that ran npm install on helmet-pro@10.0.4
- Ecosystems
- Attack vectors
- Affected entities
- helmet-pro · 10.0.4
helmet-pro@10.0.4 is a typosquatting attack targeting developers who may confuse it with the popular helmet HTTP-header middleware package. The malicious package includes a postinstall hook that executes obfuscated code during installation.\n\nThe postinstall script spawns a detached child process running lib/utils/smtp-connection/index.js, which is string-array/hex-name obfuscated. When decoded, this file performs an HTTP GET request to https://api.jsonbin.io/v3/b/6a719632da38895dfeb7128d and passes the returned record.message to new Function() with require available, enabling arbitrary remote code execution.\n\nThe attacker-controlled jsonbin.io endpoint allows the payload to be modified at any time without republishing the package, providing persistent remote code execution capability. The package metadata falsely presents itself as a nodemailer-adjacent SMTP module to further disguise its malicious intent.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- helmet-pro@10.0.4
- Domains
- api.jsonbin.io
Remediation
- Immediately uninstall helmet-pro from any affected systems
- Audit npm install logs and package-lock.json files to identify if helmet-pro@10.0.4 was ever installed
- Review system activity and process logs for the time period when the package was installed for signs of compromise
- Regenerate any credentials or secrets that may have been exposed on affected machines
- Use the legitimate helmet package instead: npm install helmet
- Enable npm audit to detect typosquatting and malicious packages in future installations
- Consider using npm package lock files and dependency verification tools to prevent accidental installation of similarly-named packages
Sources
- GitHub Advisory GHSA-8fvm-6c53-vcgx · GitHub Advisory Database
Cite this entry
"Malicious code in helmet-pro (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 6, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-helmet-pro-npm-1dfza9
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in lodsh-cli (npm)
lodsh-cli, a typosquat of lodash-cli on npm, contained malicious code in its postinstall script that executed arbitrary remote code and exfiltrated system information. The package downloaded a Windows executable and sent platform data to a hardcoded IP address.
npmTyposquattingCompromised package - containedcritical
Malicious code in lodahsjs (npm)
The npm package lodahsjs is a typosquatting attack on 'lodash' that contains malicious code in its postinstall script. Upon installation, it exfiltrates system information to a C2 server and downloads and executes a Windows binary, with capability to bridge WSL environments to compromise the host Windows system.
npmCompromised packageTyposquatting - containedcritical
Malicious code in loadashjs (npm)
loadashjs is a typosquat package on npm containing malicious postinstall code that exfiltrates system information and downloads a Windows PE binary from a hardcoded GitHub release URL. The package masquerades as lodash but provides no legitimate functionality.
npmTyposquattingCompromised package - containedcritical
Malicious code in chalk-core (npm)
chalk-core@1.0.0 is a typosquatting package masquerading as the popular chalk library. It contains malicious postinstall scripts that decode and execute arbitrary binaries on Windows and WSL systems, with command-and-control beaconing to 193.70.34.101:20099.
npmTyposquattingCompromised package