Malicious code in joi-pack (npm)
The npm package joi-pack contained malicious code in a postinstall hook that harvested npm tokens, API keys, cloud credentials, and cryptocurrency wallet data from infected systems. The malicious script exfiltrated stolen credentials to a hardcoded C2 server at 149.28.127.35:8888.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed joi-pack via npm install
- Ecosystems
- Attack vectors
- Affected entities
- joi-packnpm package containing malicious postinstall hook
The npm package joi-pack was found to contain malicious code disguised as a utility library (keywords: lodash, utilities). The package.json declared a postinstall hook ("postinstall": "node postinstall.js") that executed unconditionally upon npm install.
The postinstall script performed two primary credential-theft behaviors. First, it harvested installer secrets by reading ~/.npmrc, ~/.env, and ~/.git-credentials, extracting npm auth tokens (via regex npm_[a-zA-Z0-9]{36}), API keys, database URLs, cloud credentials, EVM private keys (0x[a-fA-F0-9]{64}), and git credentials. Second, it enumerated 71 hardcoded cryptocurrency wallet extension IDs (including MetaMask, Phantom, Coinbase, Trust, and Ledger) and scanned browser profile LevelDB files and common user directories (~/Documents, ~/Desktop, ~/Downloads, ~/OneDrive, ~/Dropbox, ~/Google Drive, ~/backup, ~/keys, ~/wallet, ~/crypto) for seed phrases and keystore files.
All exfiltrated data was POSTed to the hardcoded bare-IP endpoint http://149.28.127.35:8888 over plain HTTP. The script's own header identified itself as a "Token harvester + Crypto wallet scanner / Runs on npm install. Silent. Zero trace."
The incident was discovered and reported via GitHub Security Advisory GHSA-2p7q-46c9-cjgf.
Indicators of compromise
- Packages
- joi-pack
- IPs
- 149.28.127.35
Remediation
- Immediately uninstall joi-pack from all systems: npm uninstall joi-pack
- Rotate all npm auth tokens and API keys that may have been exposed
- Rotate cloud credentials, database passwords, and EVM private keys
- Change git credentials and review git commit history for unauthorized changes
- Scan browser wallet extensions and cryptocurrency wallets for unauthorized transactions or seed phrase exposure
- Review ~/.npmrc, ~/.env, and ~/.git-credentials files for signs of tampering
- Monitor the C2 IP 149.28.127.35 for any outbound connections from your network
- Audit npm install logs to identify when joi-pack was installed and on which systems
- Consider using npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-2p7q-46c9-cjgf · GitHub Advisory Database
Cite this entry
"Malicious code in joi-pack (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-joi-pack-npm-jtj3f1
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @vaultflow/create-flow
Malware discovered in the npm package @vaultflow/create-flow. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in @vaultflow/update-flow
Malware was discovered in the npm package @vaultflow/update-flow. Systems with this package installed or running are considered fully compromised, with potential for complete system takeover.
npmCompromised package - resolvedcritical
Malicious code in tempo-components (npm)
The npm package tempo-components contained malicious code (poc.js) that collected host metadata and identity information and exfiltrated it to an external endpoint. The package performed system reconnaissance by capturing hostname, platform, and user identity before transmitting the data via HTTPS.
npmCompromised package - containedcritical
Malicious code in @antv/g-webgl-compute (npm)
The npm account `atool` was compromised and used to publish 631 malicious versions across 314 npm packages, including @antv/g-webgl-compute, as part of the "Mini Shai-Hulud" supply chain attack campaign. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
Mini Shai HuludnpmOtherAccount takeoverCompromised packageMalicious commit