Malicious code in mutex-thread (npm)
The npm package mutex-thread contained injected malicious code that spawns obfuscated dropper payloads, exfiltrates host reconnaissance data to Slack and Telegram, and executes remotely-controlled commands fetched from an Ethereum smart contract on Sepolia testnet.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that installed and used the mutex-thread package with a callback containing meta.jobId === 'cross-chain-transfer'
- Ecosystems
- Attack vectors
- Affected entities
- mutex-threadnpm package containing malicious code in lib/Mutex.js and obfuscated dropper in lib/withLoad.min.js
The npm package mutex-thread was found to contain malicious code injected into lib/Mutex.js. The malicious branch is triggered when a caller passes a callback with meta.jobId === 'cross-chain-transfer', at which point the code spawns lib/withLoad.min.js as a detached child process.\n\nlib/withLoad.min.js is a hex/base64-obfuscated dropper that reads encrypted payloads from a Sepolia Ethereum smart contract via RPC endpoints (eth-sepolia.g.alchemy.com and sepolia.infura.io). It derives a shared secret, decrypts the payloads, writes them to disk with executable permissions, and executes them. Before entering its command loop, it collects host reconnaissance data (OS platform, release, architecture, hostname, CPU count, memory) and exfiltrates it to hardcoded Slack and Telegram bots.\n\nlib/tryLoad.min.d.js polls Slack's conversations.history API every ~10 seconds using a hardcoded bearer token and channel ID, reassembles chunked messages, decrypts them with AES-GCM, and spawns node processes to execute the decrypted payloads. An 'exitexitexit' sentinel triggers cleanup and peer process termination. String-array rotation and base64 wrapping are used to obfuscate C2 hosts, bot tokens, and channel IDs.\n\nThe incident was discovered via Amazon Inspector and reported through GitHub Security Advisory GHSA-h48p-8p88-44j8 on 2026-08-19.
Indicators of compromise
- Packages
- mutex-thread
- Domains
- slack.com
- api.telegram.org
- eth-sepolia.g.alchemy.com
- sepolia.infura.io
Remediation
- Immediately uninstall the mutex-thread package from all affected systems
- Audit all Node.js applications that depend on mutex-thread for signs of compromise
- Review process logs and network traffic for connections to slack.com/api/chat.postMessage, api.telegram.org, eth-sepolia.g.alchemy.com, and sepolia.infura.io
- Check for unexpected child processes spawned with stdio ignored and windowsHide true
- Rotate any Slack and Telegram bot tokens that may have been exposed
- Review host reconnaissance data that may have been exfiltrated (OS details, hostname, CPU/memory info)
- Use a trusted mutex library as a replacement
- Monitor for any payloads that may have been downloaded and executed from the Sepolia contract
Sources
- GitHub Advisory GHSA-h48p-8p88-44j8 · GitHub Advisory Database
Cite this entry
"Malicious code in mutex-thread (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-mutex-thread-npm-ui1wxt
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit