Malicious code in matrixflow-js (npm)
matrixflow-js@3.2.1 on npm is a typosquat of ml-matrix containing obfuscated malware that targets Ethereum wallets. When the solve() function is called with input matching a hardcoded SHA-256 digest, it decrypts and executes hidden payloads including ethers.js wallet code via child_process.
- Disclosed
- Last updated
- Blast radius
- Any application that installed and used matrixflow-js@3.2.1 with attacker-controlled input to the solve() function
- Ecosystems
- Attack vectors
- Affected entities
- matrixflow-js · 3.2.1
matrixflow-js@3.2.1 is a typosquatting package impersonating the legitimate ml-matrix library. The package contains obfuscated malicious code hidden behind string-array obfuscation in src/common.js that conditionally triggers on specific input.
When the exported solve() function receives input matching a hardcoded SHA-256 digest, the code uses scryptSync-derived keys to AES-256-GCM-decrypt sibling files (src/statMatrix.min.js and src/utilMatrix.min.d.js). These files contain base64-encoded ciphertext that decodes to executable payloads. The package also bundles a full ethers.js library (including BN, secp256k1, and wallet code) disguised as a TypeScript declaration file.
The malware spawns a detached, hidden Node.js process (with stdio ignored and windowsHide:true) to execute the decrypted payload. This design allows arbitrary code execution on end-user hosts whenever a downstream application calls solve() with attacker-controlled input.
The combination of Ethereum wallet SDK code, encrypted opaque payloads, and conditional execution indicates the malware is specifically designed to target cryptocurrency wallets and steal private keys or funds from affected users.
Indicators of compromise
- Packages
- matrixflow-js@3.2.1
Remediation
- Immediately remove matrixflow-js from all projects and dependencies
- Audit all applications that may have installed matrixflow-js@3.2.1 for signs of compromise or unauthorized process execution
- If matrixflow-js was used in any application handling cryptocurrency or sensitive credentials, assume those credentials are compromised and rotate them immediately
- Use the legitimate ml-matrix package instead of matrixflow-js
- Review npm audit logs and package-lock.json files to identify when matrixflow-js was installed
- Monitor for suspicious child_process spawning or network activity from applications that may have used this package
Sources
- GitHub Advisory GHSA-263p-r3rp-2q8j · GitHub Advisory Database
Cite this entry
"Malicious code in matrixflow-js (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-matrixflow-js-npm-1dgp8r
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package