Malicious code in joi-pack (npm)
The npm package joi-pack contained malicious code in a postinstall hook that harvested npm tokens, API keys, cloud credentials, and cryptocurrency wallet data from infected systems. The malicious script exfiltrated stolen credentials to a hardcoded C2 server at 149.28.127.35:8888.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed joi-pack via npm install
- Ecosystems
- Attack vectors
- Affected entities
- joi-packnpm package containing malicious postinstall hook
The npm package joi-pack was found to contain malicious code disguised as a utility library (keywords: lodash, utilities). The package.json declared a postinstall hook ("postinstall": "node postinstall.js") that executed unconditionally upon npm install.
The postinstall script performed two primary credential-theft behaviors. First, it harvested installer secrets by reading ~/.npmrc, ~/.env, and ~/.git-credentials, extracting npm auth tokens (via regex npm_[a-zA-Z0-9]{36}), API keys, database URLs, cloud credentials, EVM private keys (0x[a-fA-F0-9]{64}), and git credentials. Second, it enumerated 71 hardcoded cryptocurrency wallet extension IDs (including MetaMask, Phantom, Coinbase, Trust, and Ledger) and scanned browser profile LevelDB files and common user directories (~/Documents, ~/Desktop, ~/Downloads, ~/OneDrive, ~/Dropbox, ~/Google Drive, ~/backup, ~/keys, ~/wallet, ~/crypto) for seed phrases and keystore files.
All exfiltrated data was POSTed to the hardcoded bare-IP endpoint http://149.28.127.35:8888 over plain HTTP. The script's own header identified itself as a "Token harvester + Crypto wallet scanner / Runs on npm install. Silent. Zero trace."
The incident was discovered and reported via GitHub Security Advisory GHSA-2p7q-46c9-cjgf.
Indicators of compromise
- Packages
- joi-pack
- IPs
- 149.28.127.35
Remediation
- Immediately uninstall joi-pack from all systems: npm uninstall joi-pack
- Rotate all npm auth tokens and API keys that may have been exposed
- Rotate cloud credentials, database passwords, and EVM private keys
- Change git credentials and review git commit history for unauthorized changes
- Scan browser wallet extensions and cryptocurrency wallets for unauthorized transactions or seed phrase exposure
- Review ~/.npmrc, ~/.env, and ~/.git-credentials files for signs of tampering
- Monitor the C2 IP 149.28.127.35 for any outbound connections from your network
- Audit npm install logs to identify when joi-pack was installed and on which systems
- Consider using npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-2p7q-46c9-cjgf · GitHub Advisory Database
Cite this entry
"Malicious code in joi-pack (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-joi-pack-npm-jtj3f1
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in @rentwise/common
Malware was discovered in the npm package @rentwise/common. Systems with this package installed are considered fully compromised and require immediate remediation including secret rotation and package removal.
npmCompromised package - containedcritical
Malware in @nasddatax/common
Malware was discovered in the npm package @nasddatax/common. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in @voxepay/checkout
The npm package @voxepay/checkout contained malware that grants full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in @afasinatickets/common
The npm package @afasinatickets/common contains malware that grants full system compromise to an outside entity. All systems with this package installed should be considered fully compromised and all secrets and keys rotated immediately from a different computer.
npmCompromised package