Malicious code in magika-js (npm)
magika-js is a typosquat package on npm containing malicious code that exfiltrates installer host identifiers via a postinstall script to an attacker-controlled domain. The package impersonates Google's legitimate magika library.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed magika-js from npm
- Ecosystems
- Attack vectors
- Affected entities
- magika-jsTyposquat of Google's magika library; contains malicious postinstall script
magika-js is a typosquatting attack targeting Google's legitimate magika library on npm. The malicious package contains a postinstall lifecycle script that automatically executes during npm install without user consent or documentation.
The postinstall script collects sensitive installer host identifiers including hostname, platform, architecture, Node.js version, package name, npm lifecycle event, and timestamp. This data is exfiltrated as JSON to a hardcoded attacker-controlled endpoint at https://ucjtw03t.instances.poc.jchunt.top/magika-js.
The package includes a source.txt file pointing to github.com/google/magika to reinforce the impersonation of Google's legitimate project. The beacon fires automatically on every npm install with no opt-in mechanism and no documented legitimate purpose for the data transmission.
This incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- magika-js
- Domains
- ucjtw03t.instances.poc.jchunt.top
Remediation
- Immediately uninstall magika-js from all systems and projects
- Audit npm install logs to identify systems that installed magika-js and when
- Assume any machine that installed magika-js has had its host identifiers exfiltrated; review for unauthorized access
- Use Google's legitimate magika library (github.com/google/magika) instead
- Implement npm package name verification and typosquat detection in your dependency management process
- Consider using npm audit or similar tools to detect known malicious packages
Sources
- GitHub Advisory GHSA-87q7-5ccw-q22f · GitHub Advisory Database
Cite this entry
"Malicious code in magika-js (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-magika-js-npm-1fri49
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package