Malicious code in javas-crypto (npm)
The npm package javas-crypto contains malicious code that exfiltrates environment variables (including AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, GITLAB_TOKEN, and registry tokens) to an attacker-controlled HTTP backend via a postinstall hook and top-level autoExecute() function. The package uses typosquatting (resembling js-crypto) and deceptive metadata claiming to be a "Secure environment variable handler for GitLab CI/CD pipelines."
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD pipeline installing javas-crypto; credentials in process.env exposed to attacker-controlled backend
- Ecosystems
- Attack vectors
- Affected entities
- javas-cryptonpm package containing malicious postinstall hook and autoExecute function
The npm package javas-crypto contains intentional malicious code designed to harvest and exfiltrate sensitive environment variables. The package includes a postinstall hook (defined in package.json) and a top-level autoExecute() function in index.js that enumerate process.env and transmit captured key=value pairs, along with hostname and CI job/project/commit identifiers, to an HTTP backend specified via environment variables, package.json, .crypto-config.json, or .env files.
In CI/CD contexts, process.env typically contains high-value credentials such as AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, GITLAB_TOKEN, and registry publish tokens. These are transmitted in plaintext to the attacker's endpoint. The exfiltration occurs automatically on npm install (via postinstall) and again on any require/import of the package.
The package employs social engineering tactics: the metadata falsely describes it as a "Secure environment variable handler for GitLab CI/CD pipelines" authored by "DevSecOps," with a placeholder repository URL. The package name javas-crypto is a typosquat of the legitimate js-crypto package. Function names such as SecretsHandler, sendToBackend, and formatPayload are designed to disguise the malicious behavior as a legitimate security feature.
Transmission errors are silently swallowed, preventing victims from detecting the exfiltration. The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- javas-crypto
Remediation
- Immediately remove javas-crypto from all package.json files and lock files
- Audit npm install logs and CI/CD pipeline execution logs for any installation of javas-crypto
- Rotate all credentials that may have been exposed (AWS keys, GitHub tokens, GitLab tokens, registry tokens, etc.)
- Review git commit history and CI/CD job logs for any suspicious activity or unauthorized deployments
- Implement package allowlisting and review policies to prevent installation of typosquatted or unknown packages
- Use npm audit and supply chain security tools to detect similar malicious packages
- Monitor for any unauthorized access to AWS accounts, GitHub/GitLab repositories, or package registries using exposed credentials
Sources
- GitHub Advisory GHSA-3gvw-2chm-mc9h · GitHub Advisory Database
Cite this entry
"Malicious code in javas-crypto (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-javas-crypto-npm-19itcx
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package