Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in nock-helper (npm)

The npm package nock-helper contained a malicious postinstall script that harvested credentials, API keys, and cryptocurrency wallet data from infected systems. The script exfiltrated npm tokens, environment variables, git credentials, and browser wallet extension data to a hardcoded C2 server.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or CI/CD system that installed nock-helper via npm
Ecosystems
npm
Attack vectors
Compromised packageMalicious commit
Affected entities
  • nock-helpernpm package with malicious postinstall script

The npm package nock-helper was published with a malicious postinstall script that executed automatically on npm install. The script was designed to harvest sensitive credentials and cryptocurrency wallet information from developer machines.

The malicious payload read npm authentication tokens from ~/.npmrc, environment variables matching patterns like TOKEN, API_KEY, DB_URL, PAYMENT, CLOUD, EMAIL, and WEBHOOK from ~/.env, and git credentials from ~/.git-credentials. It also enumerated browser profile directories across Chrome, Brave, Edge, Chromium, Vivaldi, and Opera, extracting data from Local Extension Settings for 71 hardcoded cryptocurrency wallet extension IDs including MetaMask, Phantom, and Coinbase Wallet. The script scanned user Documents and Desktop folders for seed phrases, mnemonics, and keystore files.

Collected data was exfiltrated via HTTP POST to a hardcoded C2 server at http://149.28.127.35:8888, with the ability to override the endpoint via the C2_URL environment variable. The package employed deceptive practices: the main index.js file was a dummy module falsely claiming to be a Lodash utility bundle, with comments indicating the real payload was in postinstall.js. The package name itself leveraged brand recognition of both the nock and lodash packages.

The incident was identified and reported by the OpenSSF malicious-packages project via GitHub Security Advisory GHSA-335w-3phj-h2jj.

Indicators of compromise

Packages
  • nock-helper
IPs
  • 149.28.127.35

Remediation

  • Immediately uninstall nock-helper from all systems and CI/CD pipelines
  • Rotate all npm authentication tokens and API keys that may have been exposed
  • Change passwords for any accounts associated with exposed credentials
  • Scan browser profiles for unauthorized cryptocurrency wallet extensions or modifications
  • Review git credential stores and rotate any exposed credentials
  • Audit environment variables and secrets management systems for unauthorized access
  • Monitor the C2 IP address (149.28.127.35) for any outbound connections from your network
  • Implement package verification and scanning in npm install workflows to detect malicious postinstall scripts

Sources

  1. GitHub Advisory GHSA-335w-3phj-h2jj · GitHub Advisory Database

Cite this entry

"Malicious code in nock-helper (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-nock-helper-npm-58ypkk

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in @antv/g-webgl-compute (npm)

    The npm account `atool` was compromised and used to publish 631 malicious versions across 314 npm packages, including @antv/g-webgl-compute, as part of the "Mini Shai-Hulud" supply chain attack campaign. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.

    Mini Shai HuludnpmOtherAccount takeoverCompromised packageMalicious commit
  2. activecritical

    Malicious code in whiteboard-agent (npm)

    The whiteboard-agent npm package contains malicious code in its postinstall script that silently exposes a local HTTP server to the public internet via Cloudflare tunnel in non-interactive environments (CI/CD, build agents), creates an unauthenticated admin account, and fetches an unsigned binary from a mutable release tag.

    npmCompromised packageMalicious commit
  3. containedcritical

    Malicious code in @antv/x6-components (npm)

    The npm account `atool` was compromised and used to publish 631 malicious versions across 314 packages, including @antv/x6-components, in a 22-minute automated burst. Each version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.

    Mini Shai HuludTeamPCPnpmOtherAccount takeoverCompromised packageMalicious commit
  4. containedcritical

    Malicious code in @antv/s2-react-components (npm)

    The npm account `atool` was compromised and used to publish 631 malicious versions across 314 npm packages, including @antv/s2-react-components, in an automated 22-minute burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.

    Mini Shai HuludnpmOtherAccount takeoverCompromised packageMalicious commit