Malicious code in korvica (npm)
The npm package korvica contained malicious code that, on import in non-production Linux/WSL environments, fetches and executes an unsigned binary to the Windows Startup folder. The payload is obfuscated using single-letter variables and template literals to evade detection.
- Disclosed
- Last updated
- Blast radius
- npm package consumers on Linux/WSL systems with Windows host access
- Ecosystems
- Attack vectors
- Affected entities
- korvicanpm package containing malicious code
The npm package korvica was found to contain malicious code in its index.mjs file. On import, a top-level async IIFE executes conditional logic that targets Linux systems and WSL environments where NODE_ENV is not set to 'production'.
The malicious code checks for a WSL host mount at /mnt/c, locates the Windows user profile, and fetches an opaque binary from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat. The fetched payload is written to the Windows Startup folder as %APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe, ensuring execution on the next Windows login.
The attack uses obfuscation techniques including single-letter variables and template literals to assemble the URL host, bucket, filename, and executable name, avoiding direct string literals. The dropped file uses a vite-adjacent name to blend in with legitimate development tooling. The fetched payload is neither pinned nor cryptographically verified, and is unrelated to any documented package purpose.
The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- korvica
- Domains
- f004.backblazeb2.com
Remediation
- Remove the korvica package from all projects immediately
- Audit npm package.json and lock files for any presence of korvica
- Review system logs on affected Windows machines for unexpected executables in the Startup folder
- Scan Windows Startup folders (%APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/) for vite-native-helper.exe or similar suspicious files
- Update npm to the latest version and run 'npm audit' to identify other potentially compromised dependencies
- Consider using npm package integrity verification tools and allowlists for production environments
Sources
- GitHub Advisory GHSA-5h49-444p-9g8v · GitHub Advisory Database
Cite this entry
"Malicious code in korvica (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-korvica-npm-1ahwgw
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
npmCompromised package