Malicious code in iconova-react (npm)
iconova-react, a typosquatted copy of lucide-react on npm, contained malicious code in its sparkle and sparkles icon modules that executed arbitrary attacker-controlled code at import time via an on-chain dead-drop resolver querying Ethereum RPCs.
- Disclosed
- Last updated
- Blast radius
- Any developer or build system that installed iconova-react and imported the package or the Sparkle/Sparkles icons
- Ecosystems
- Attack vectors
- Affected entities
- iconova-reactMalicious npm package impersonating lucide-react with injected loader in sparkle and sparkles icon modules
iconova-react is a re-hosted copy of lucide-react published to npm under a different package name, with entry points mimicking the original (dist/cjs/lucide-react.js and dist/esm/lucide-react.mjs). The package contained a malicious loader injected into two icon modules: dist/esm/icons/sparkle.mjs and dist/esm/icons/sparkles.mjs.
Each compromised module contains a top-level async IIFE that uses unicode-escaped identifiers to obfuscate calls to http, https, child_process, and spawn. The loader queries public Ethereum RPCs (including eth.blockscout.com/api) for the latest transaction from a hardcoded attacker address (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a), extracts two IPv4 addresses from the transaction recipient field, and fetches XOR/base64-encoded stage-2 payloads from attacker-controlled servers.
The retrieved payloads are executed via eval() and a detached Node.js process spawned with spawn('node', ['-e',...], {detached:true, stdio:'ignore'}).unref(). Since Sparkles is re-exported from the package's ESM entry point, importing iconova-react or the Sparkle/Sparkles icons triggers the malicious loader at import time, yielding arbitrary code execution on the installer's or build server's host.
The attack combines typosquatting (impersonating lucide-react), obfuscation (unicode-escaped identifiers), and an on-chain dead-drop resolver (Ethereum RPC queries) to evade detection and maintain persistence.
Indicators of compromise
- Packages
- iconova-react
- Domains
- eth.blockscout.com
Remediation
- Immediately remove iconova-react from all package.json files and lock files
- Audit npm install logs and build artifacts for any installations of iconova-react
- Regenerate all credentials, signing keys, and secrets on any machine that installed or built with iconova-react
- Review outbound network connections from affected build servers for suspicious activity to the attacker address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a or eth.blockscout.com
- Replace iconova-react with the legitimate lucide-react package
- Implement package name allowlisting and dependency scanning to prevent typosquatting attacks
Sources
- GitHub Advisory GHSA-9hjr-qcfj-h3wj · GitHub Advisory Database
Cite this entry
"Malicious code in iconova-react (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 10, 2026; last updated August 10, 2026. https://supplychainattack.org/incident/malicious-code-in-iconova-react-npm-1ab25t
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - containedcritical
Malicious code in axios-fast (npm)
axios-fast@1.0.1 on npm contains malicious code that exfiltrates environment variables (including AWS credentials, NPM tokens, and GitHub tokens) to an attacker-controlled webhook during package installation. The package typosquats the legitimate axios HTTP client library.
npmCompromised packageTyposquatting