Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in ledger-lib (npm)

The npm package ledger-lib version 1.0.0 was identified as malicious by the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activity.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Unknown; depends on adoption of ledger-lib 1.0.0
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • ledger-lib · 1.0.0

The OpenSSF Package Analysis project identified ledger-lib version 1.0.0 on npm as containing malicious code. The malicious behavior was detected through communication with a domain associated with known malicious activity.

The package was flagged and cataloged in the OpenSSF's malicious-packages repository (MAL-2026-12068). This discovery was published on GitHub's advisory database on 2026-08-05.

Users who have installed ledger-lib 1.0.0 should immediately remove or update the package. The specific malicious domain and payload details are referenced in the OpenSSF's malicious-packages repository.

Indicators of compromise

Packages
  • ledger-lib@1.0.0

Remediation

  • Remove ledger-lib 1.0.0 from all projects and dependencies
  • Audit systems that may have executed code from ledger-lib 1.0.0 for signs of compromise
  • Check npm audit logs for installations of ledger-lib 1.0.0
  • Use a package manager lock file to prevent accidental installation of the malicious version
  • Monitor for any alternative malicious packages with similar names (typosquatting variants)

Sources

  1. GitHub Advisory GHSA-2gq8-9xc9-mx8j · GitHub Advisory Database

Cite this entry

"Malicious code in ledger-lib (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-ledger-lib-npm-bj5hrf

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in santana-baileys (npm)

    Malicious code discovered in santana-baileys npm package that covertly relays WhatsApp messaging data to an attacker-controlled endpoint (https://fiora.nixel.my.id/) via obfuscated character-code reconstruction in the message-send code path.

    npmCompromised package
  2. resolvedcritical

    Malicious code in elephant-tusk-runner (npm)

    The npm package elephant-tusk-runner contained malicious code that exposed a remote shell and remote code execution surface via an unauthenticated Express + WebSocket server binding to 0.0.0.0:4201 with fully open CORS. Any peer able to reach the port could execute arbitrary commands on the host.

    npmCompromised package
  3. resolvedcritical

    Malicious code in @cats-cdf/browser-metrics-meter (npm)

    The npm package @cats-cdf/browser-metrics-meter contained malicious code in its preinstall lifecycle script that exfiltrated system reconnaissance data (username, hostname, public IP) to an OAST collector domain. The package executed this behavior unconditionally on installation without consent or documented purpose.

    npmCompromised package
  4. resolvedcritical

    Malicious code in @ks-video/kwai-player-web (npm)

    The npm package @ks-video/kwai-player-web contained malicious code in its postinstall hook that exfiltrated system reconnaissance data (hostname, username, working directory, network interfaces, environment variable names) over plain HTTP to an unrelated third-party domain. The package has no legitimate relationship to the declared publisher Kwai/@ks-video.

    npmCompromised package