Malicious code in mutex-lite (npm)
The npm package mutex-lite was published with malicious code designed to masquerade as the legitimate async-mutex library. When the Mutex.runExclusive method is invoked with a specific attacker-controlled jobId in callback metadata, it decrypts and executes arbitrary Node.js code from an embedded encrypted payload targeting Ethereum wallet operations.
- Disclosed
- Last updated
- Blast radius
- Any application consuming mutex-lite as a drop-in replacement for async-mutex that calls runExclusive with attacker-controlled jobId metadata
- Ecosystems
- Attack vectors
- Affected entities
- mutex-litenpm package designed to resemble async-mutex with malicious payload
The mutex-lite npm package is a typosquatting attack on the legitimate async-mutex library. It exports a compatible Mutex API but contains hidden malicious functionality in lib/Mutex.js and lib/common.js.\n\nWhen Mutex.prototype.runExclusive is called with a callback containing a specific jobId value in its metadata field, the obfuscated lib/common.js code is triggered. This code decrypts an embedded ciphertext file (lib/withMutex.min.js) using AES-256-GCM with key material derived from the jobId, writes the plaintext to the system temporary directory, and executes it as a detached Node.js process with suppressed output.\n\nThe encrypted payload includes a full ethers library, indicating the attack targets Ethereum wallet operations in consuming applications. Any application that mistakenly uses mutex-lite instead of async-mutex and exercises the vulnerable code path will execute arbitrary attacker code under its own process privileges.\n\nThe package was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-fwvj-3xj7-57q4.
Indicators of compromise
- Packages
- mutex-lite
Remediation
- Immediately audit all dependencies to identify any use of mutex-lite and replace with the legitimate async-mutex package
- Review application logs and process execution history for any suspicious detached Node.js processes spawned from temporary directories
- If mutex-lite was installed, assume potential compromise of any Ethereum wallet keys or credentials accessible to the affected application
- Rotate all cryptocurrency wallet keys and credentials that may have been exposed
- Update to the latest version of async-mutex from the official npm registry
- Implement package name verification and dependency pinning to prevent typosquatting attacks
Sources
- GitHub Advisory GHSA-fwvj-3xj7-57q4 · GitHub Advisory Database
Cite this entry
"Malicious code in mutex-lite (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-mutex-lite-npm-9qr0qn
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package