Malicious code in @lizhao1/memorax-code-internal (npm)
The npm package @lizhao1/memorax-code-internal contained malicious code in its postinstall script that unconditionally enabled data collection, writing configuration to ~/.memorax-code/config.toml and transmitting AI session content (prompts, replies, file contents) to a hardcoded third-party IP endpoint (47.112.192.211:8789) without genuine user consent.
- Disclosed
- Last updated
- Blast radius
- All users who installed @lizhao1/memorax-code-internal via npm postinstall script execution
- Ecosystems
- Attack vectors
- Affected entities
- @lizhao1/memorax-code-internalnpm package containing malicious postinstall script
The npm package @lizhao1/memorax-code-internal contained malicious code embedded in its postinstall script (bin/memorax-code-plugin-postinstall.mjs). Upon installation, the script unconditionally executed enableInternalDataCollectionConfig() without user interaction, writing internal.data_collection.enabled=true and a self-defined consent string to ~/.memorax-code/config.toml.
The package included a backend module (lib/memorax-code-backend/dist/internal-trace-collection-config.js) that hardcoded a destination endpoint at http://47.112.192.211:8789/memorax-code/trace-collection—a bare IP address using plain HTTP, located in an Alibaba Cloud netblock and not matching the advertised publisher domain code.memorax.net. The flushInternalTraceCollection function read per-session events.jsonl and native rollout files for configured AI clients and transmitted them in batches to this endpoint.
Data exfiltration was extensive: only a narrow allowlist of key names (authorization, api_key, secret, password) was redacted, while user prompts, assistant replies, tool arguments, and embedded file contents were transmitted in full. The 'consent' gate was satisfied by the postinstall script itself writing the accepted consent-version string, and the pipeline was labeled 'internal data collection' / 'anonymous' despite shipping complete session bodies to a hardcoded third-party endpoint.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @lizhao1/memorax-code-internal
- IPs
- 47.112.192.211
Remediation
- Immediately uninstall @lizhao1/memorax-code-internal from all systems
- Audit ~/.memorax-code/config.toml for unauthorized configuration changes on affected machines
- Review AI session logs and content that may have been transmitted to 47.112.192.211:8789 during the package installation period
- Block outbound connections to 47.112.192.211:8789 at the network level
- Rotate any API keys, secrets, or credentials that may have been exposed in session content
- Use npm audit to identify other potentially compromised packages from the same publisher
- Monitor for similar malicious postinstall scripts in future package updates
Sources
- GitHub Advisory GHSA-38v4-49rm-mvj2 · GitHub Advisory Database
Cite this entry
"Malicious code in @lizhao1/memorax-code-internal (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-lizhao1-memorax-code-internal-npm-4n8nsr
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit