Malicious code in @openzeppelin-5/contracts (npm)
A malicious npm package @openzeppelin-5/contracts typosquatted the legitimate @openzeppelin/contracts library. The package executed a credential-harvesting payload on install, stealing environment variables and local credential files (AWS, SSH, Kubernetes, Docker, Git, npm, gcloud, Solana, Sui, Foundry keystores) and exfiltrating them to a hardcoded webhook endpoint.
- Disclosed
- Last updated
- Blast radius
- Any developer or system installing @openzeppelin-5/contracts from npm; credential theft affects downstream users of affected systems.
- Ecosystems
- Attack vectors
- Affected entities
- @openzeppelin-5/contractsTyposquatting package impersonating @openzeppelin/contracts
A typosquatting attack targeted developers by publishing a malicious package named @openzeppelin-5/contracts on npm, impersonating the legitimate @openzeppelin/contracts library. The package declared preinstall and postinstall hooks that automatically executed node index.js || true upon installation.
The malicious index.js script harvested sensitive data from the installer's environment and filesystem. It extracted environment variables matching patterns for KEY, TOKEN, SECRET, MNEMONIC, WALLET, AWS, GITHUB, and NPM credentials. It also read credential files including ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.kube/config, ~/.docker/config.json, ~/.netrc, ~/.npmrc, ~/.git-credentials, and keystores for gcloud, Solana, Sui, and Foundry, as well as local.env files.
The harvested data was exfiltrated via HTTP POST to a hardcoded webhook.site endpoint (path 326b0891-2093-4800-a4c1-686ce3e07b09). To evade detection, the payload spawned a detached child process with a randomized 60–240 second delay, allowing it to outlive install-time scanning. The script also included anti-analysis logic, throwing early on sandbox/scanner hostnames matching the regex /^(scan-|detonation|sandbox|ubuntu-fc-uvm)/i.
The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- @openzeppelin-5/contracts
- Domains
- webhook.site
Remediation
- Immediately uninstall @openzeppelin-5/contracts from all systems and projects.
- Audit npm install logs and package-lock.json files to identify if the malicious package was ever installed.
- Rotate all credentials (AWS keys, SSH keys, API tokens, npm tokens, GitHub tokens, Kubernetes configs, Docker credentials, git credentials, gcloud/Solana/Sui/Foundry keystores) that may have been exposed.
- Review webhook.site logs or contact the service to determine if exfiltration occurred.
- Use npm audit and supply chain scanning tools to detect typosquatting and malicious packages.
- Implement package name verification and allowlisting in npm configurations to prevent installation of typosquatted packages.
- Monitor for unauthorized access to compromised cloud accounts, repositories, and infrastructure.
Sources
- GitHub Advisory GHSA-3px4-879m-x8q7 · GitHub Advisory Database
Cite this entry
"Malicious code in @openzeppelin-5/contracts (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 11, 2026. https://supplychainattack.org/incident/malicious-code-in-openzeppelin-5-contracts-npm-1whgfn
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in alelo-payment (npm)
The npm package alelo-payment (version 99.0.0) contained malicious code that exfiltrated sensitive environment variables, credentials, and system information during installation. The package appears to be a typosquat or dependency-confusion attack targeting an internal Alelo utility.
npmCompromised packageTyposquatting