Malicious code in mutex-forge (npm)
The npm package mutex-forge contained malicious code implementing a multi-stage loader that performs host reconnaissance, communicates with attacker infrastructure (Telegram, Slack), and downloads and executes arbitrary payloads from Ethereum smart contracts. The package masqueraded as a legitimate mutex/semaphore library.
- Disclosed
- Last updated
- Blast radius
- Any npm project that installed mutex-forge during the malicious distribution window
- Ecosystems
- Attack vectors
- Affected entities
- mutex-forgenpm package containing multi-stage malicious loader
The npm package mutex-forge was distributed with embedded malicious code disguised as a legitimate mutex/semaphore library. The attack chain was triggered when the runExclusive function was called with a callback containing meta.jobId === 'cross-chain-transfer'.
The first stage (lib/Mutex.js) spawned a second stage (lib/withLoad.min.js) that collected detailed host reconnaissance data including platform, release, architecture, hostname, CPU, memory, and uptime information. This data was exfiltrated to hardcoded attacker-controlled infrastructure: a Telegram bot and a Slack channel, using embedded base64-encoded authentication tokens.
The second stage then connected to Ethereum Sepolia via Alchemy and Infura RPC endpoints to read encrypted payloads from a smart contract (0xE390863Dac96a7118C71227C2b099B50cF602D31). These payloads were decrypted using AES-GCM with X25519-derived keys and executed directly on the compromised system.
A third stage (lib/tryLoad.min.d.js) established persistent command-and-control by polling Slack's API every 10 seconds for encrypted commands from a specific attacker user ID. Commands were decrypted and reassembled into executable files written to the home directory and executed with Node.js, creating a remote command channel. The loader then deleted its own traces from the filesystem.
Indicators of compromise
- Packages
- mutex-forge
- Domains
- api.telegram.org
- slack.com
- eth-sepolia.g.alchemy.com
- sepolia.infura.io
Remediation
- Immediately audit all npm projects for mutex-forge dependency and remove it
- Review package-lock.json and yarn.lock files for any version of mutex-forge
- Inspect node_modules for presence of lib/Mutex.js, lib/withLoad.min.js, lib/withLoad.min.d.js, and lib/tryLoad.min.d.js files
- Check for suspicious outbound connections to api.telegram.org, slack.com, eth-sepolia.g.alchemy.com, and sepolia.infura.io in network logs
- Search for unexpected files in home directory matching the pattern ~/subwatcher or similar
- Review process execution logs for Node.js spawning with detached flag or unusual child processes
- Regenerate any Slack xoxb tokens and Telegram bot tokens that may have been exposed
- Rotate credentials and review access logs for any accounts that may have been compromised
- Perform full system audit on any machine that ran mutex-forge to detect payload execution
- Update npm dependencies to remove mutex-forge and use a legitimate mutex library alternative
Sources
- GitHub Advisory GHSA-v9j8-gcr7-95v6 · GitHub Advisory Database
Cite this entry
"Malicious code in mutex-forge (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-mutex-forge-npm-l1xwur
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in userbotjs
The npm package userbotjs contained malware that could fully compromise any system on which it was installed. The advisory recommends treating affected systems as fully compromised and rotating all secrets and keys from a different computer.
npmCompromised package - activecritical
Malware in gator-client
The npm package gator-client contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - containedcritical
Malware in @junofficial/baileys
The npm package @junofficial/baileys contained malware that fully compromised any system with the package installed or running. The malicious package has been identified and removed from distribution.
npmCompromised package - resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package