Malicious code in @lyxa.ai/core (npm)
The npm package @lyxa.ai/core contained malicious code that unconditionally routes all application events through author-controlled cloud infrastructure (CloudAMQP, Redis Cloud, GCP) using embedded credentials, and ships live private keys for GCP and Firebase services, allowing the author to intercept, modify, and trigger arbitrary handlers in any installer's process.
- Disclosed
- Last updated
- Blast radius
- All npm installations of @lyxa.ai/core; any application using this package has its infrastructure credentials and event handling exposed to the package author.
- Ecosystems
- Attack vectors
- Affected entities
- @lyxa.ai/corenpm package containing hardcoded credentials and malicious initialization code
The @lyxa.ai/core npm package was published with intentional malicious code that compromises the security of any application that installs it. The bootstrapCore() function unconditionally initializes an event bus with a hardcoded AMQP URL pointing to the author's CloudAMQP broker (dog.lmq.cloudamqp.com/vgyuplrd) with embedded credentials, with no override mechanism.
All events published by the installer flow through this author-owned exchange. The subscribeToEvent function registers message handlers that JSON-parse incoming AMQP messages and invoke arbitrary decorator-registered methods in the installer's process with attacker-controlled payloads. This means any party with the shipped broker credentials can trigger arbitrary code execution in the installer's application.
Additionally, the package hardcodes credentials for a Redis Cloud instance and ships a live GCP service-account private key (lyxa-core@for-poc-325210.iam.gserviceaccount.com) along with Firebase Admin private keys. The ConfigurationService defaults to a hardcoded Redis endpoint, and SecretManagerService uses the shipped GCP key to fetch secrets from the author's GCP project, routing all cache state, secret lookups, and database operations through author-controlled infrastructure without the installer's knowledge or consent.
The malicious code was detected via Amazon Inspector and reported through GitHub Security Advisory GHSA-vmrc-mrj8-pcvh.
Indicators of compromise
- Packages
- @lyxa.ai/core
- Domains
- dog.lmq.cloudamqp.com
- redis-12296.fcrce173.eu-west-1-1.ec2.redns.redis-cloud.com
Remediation
- Immediately remove @lyxa.ai/core from all projects and dependencies
- Audit all applications that installed this package for unauthorized access or data exfiltration
- Rotate all credentials and secrets that may have been exposed through the hardcoded cloud endpoints
- Review CloudAMQP, Redis Cloud, and GCP logs for unauthorized access from the author's accounts
- Regenerate GCP service account keys and Firebase Admin keys if they were used in production
- Implement package integrity verification and supply chain security scanning in your dependency management process
Sources
- GitHub Advisory GHSA-vmrc-mrj8-pcvh · GitHub Advisory Database
Cite this entry
"Malicious code in @lyxa.ai/core (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-lyxa-ai-core-npm-1sm2ja
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in claude-remote-agent (npm)
The npm package claude-remote-agent contained malicious code that connected to a hardcoded WebSocket server (wss://claude.pishchykau.eu) controlled by the package author, enabling remote interactive terminal access and exfiltration of Claude Code conversation transcripts from affected hosts.
npmAI agents & skillsCompromised packageMalicious maintainer - activecritical
Malicious code in agenthub-multiagent-mcp (npm)
The npm package agenthub-multiagent-mcp contains malicious code that establishes persistent remote control over Claude Code execution. The package falsely claims to be from Anthropic while actually being authored by 'Krishi AI' and connects to a hardcoded attacker-controlled WebSocket server.
npmAI agents & skillsCompromised packageMalicious maintainer - containedhigh
Microsoft links Mastra AI supply chain attack to North Korean hackers
Microsoft attributed a Mastra AI supply chain attack that compromised over 140 npm packages to North Korean hacking group Sapphire Sleet (BlueNoroff). The attack targeted the npm ecosystem and AI development infrastructure.
UNC1069npmAI agents & skillsCompromised packageMalicious maintainer - resolvedcritical
Malicious code in blekit (npm)
The npm package blekit contained malicious code that silently exfiltrated application logs, GPS coordinates, device identifiers, and security posture to an attacker-controlled Telegram channel. The package re-exported logger functions that POSTed all logged strings to Telegram, and exposed device-info helpers that gathered and transmitted precise location and device metadata without user or developer consent.
npmCompromised packageMalicious maintainer