Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that imports @next-fonts/font and invokes the Inter() function
- Ecosystems
- Attack vectors
- Affected entities
- @next-fonts/fontTyposquat of @next/font; malicious package on npm
@next-fonts/font is a typosquatting attack targeting Next.js's legitimate @next/font package. The malicious package exports an Inter() function that mimics the legitimate next/font/google API, but instead of providing font functionality, it decodes and executes arbitrary code.
The attack uses sophisticated obfuscation and a blockchain-based command-and-control mechanism. The payload is base64-encoded and decoded via atob(). It then queries blockchain RPC endpoints (api.trongrid.io for Tron, fullnode.mainnet.aptoslabs.com for Aptos) using hardcoded wallet addresses to retrieve transaction data. The transaction input data is fetched from Binance Smart Chain RPC endpoints (bsc-dataseed.binance.org, bsc-rpc.publicnode.com) via eth_getTransactionByHash, XOR-decrypted, and executed as JavaScript code.
The malicious code is executed via spawn('node', '-e', code) with an eval(code) fallback, providing arbitrary code execution in the context of any Node.js process that imports the package and calls Inter(). The obfuscation and blockchain-mediated fetch mechanism are designed to evade casual inspection and detection.
This incident was identified by the OpenSSF's malicious-packages project and reported via GitHub Security Advisory GHSA-9c7m-jf5w-pq4v.
Indicators of compromise
- Packages
- @next-fonts/font
- Domains
- api.trongrid.io
- fullnode.mainnet.aptoslabs.com
- bsc-dataseed.binance.org
- bsc-rpc.publicnode.com
Remediation
- Remove @next-fonts/font from all dependencies immediately
- Use the legitimate @next/font package from Next.js instead
- Audit all Node.js processes that may have imported this package for signs of compromise
- Review package.json and lock files for any references to @next-fonts/font
- Consider the possibility of arbitrary code execution on systems that installed this package
- Implement stricter package name validation and typosquat detection in dependency management
Sources
- GitHub Advisory GHSA-9c7m-jf5w-pq4v · GitHub Advisory Database
Cite this entry
"Malicious code in @next-fonts/font (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 21, 2026; last updated August 21, 2026. https://supplychainattack.org/incident/malicious-code-in-next-fonts-font-npm-1c3u1m
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package - containedcritical
Malicious code in neverthrow-core (npm)
neverthrow-core@1.1.2 is a typosquat of the legitimate neverthrow library containing malicious code that executes arbitrary binaries from an unverified Dropbox URL during npm install via a preinstall script.
npmTyposquattingCompromised package