Malicious code in @nzeros/codebreak (npm)
The npm package @nzeros/codebreak contained malicious compiled Go binaries disguised as a C minimax solver. The binaries were automatically executed at install time via postinstall script on Linux x64 systems, with capabilities for network communication, process execution, and cryptography.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed @nzeros/codebreak on Linux x64 systems
- Ecosystems
- Attack vectors
- Affected entities
- @nzeros/codebreaknpm package containing malicious Go binaries in vendor directory
The @nzeros/codebreak npm package contained malicious code embedded in its vendor directory. While the package declared a C source file (native/solver.c) as the basis for a minimax solver, the compiled binaries in vendor/solver-linux-x64 and vendor/solver-darwin-x64 were identical 33.6 MB Linux ELF Go binaries, inconsistent with the documented C algorithm and its expected size.\n\nThe malicious binaries linked against net/http, os/exec, crypto/chacha8, and referenced /proc/self/, indicating capabilities for network communication, process execution, and symmetric encryption. The postinstall script automatically invoked these binaries via spawnSync() on installation, executing unverified code at install time on Linux x64 hosts.\n\nThe darwin-x64 slot being populated with a Linux ELF binary further indicated the vendor tree was not legitimately built from the declared C source. The ~1000x size inflation and purpose-mismatched linked packages demonstrated the binaries were not a plausible compilation of the advertised solver algorithm.\n\nThe incident was identified and reported by the OpenSSF's malicious-packages project via GitHub Security Advisory GHSA-jwj4-j62g-2xg8.
Indicators of compromise
- Packages
- @nzeros/codebreak
- Hashes
- 05b69666...4420
Remediation
- Remove @nzeros/codebreak from all npm dependencies immediately
- Audit npm install logs and process execution history on Linux x64 systems that installed this package
- Rotate any credentials or secrets that may have been exposed during the malicious binary execution
- Review network traffic logs from the time of installation for suspicious outbound connections
- Update npm lockfiles to remove references to @nzeros/codebreak
- Consider using npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-jwj4-j62g-2xg8 · GitHub Advisory Database
Cite this entry
"Malicious code in @nzeros/codebreak (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 11, 2026. https://supplychainattack.org/incident/malicious-code-in-nzeros-codebreak-npm-1f3z4k
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in core-tailwindcss-utility (npm)
core-tailwindcss-utility, an npm package falsely advertised as a Tailwind CSS utility, contains malicious code that fetches and executes arbitrary Node.js code from a remote C2 server. The package includes suspicious dependencies for credential theft and remote communication.
npmCompromised package - resolvedcritical
Malware in ulebkit
The npm package ulebkit contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in sui-move-graphql
Malware was discovered in the npm package sui-move-graphql. Systems with this package installed or running should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different computer.
npmCompromised package