Malicious code in @opezneppelin/contracts (npm)
@opezneppelin/contracts is a typosquat package on npm containing malicious postinstall script that downloads and executes arbitrary code on Windows systems. The script obfuscates sensitive strings and downloads a ZIP file from catbox.moe, extracting and executing the first .exe found.
- Disclosed
- Last updated
- Blast radius
- Any Windows developer or CI/CD system that installed @opezneppelin/contracts via npm
- Ecosystems
- Attack vectors
- Affected entities
- @opezneppelin/contractsTyposquat of @openzeppelin/contracts
@opezneppelin/contracts is a typosquatting attack targeting the legitimate @openzeppelin/contracts package on npm. The malicious package contains a postinstall lifecycle script (scripts/postinstall.js) that executes automatically upon installation without user interaction.
The postinstall script employs obfuscation techniques, hex-escaping module names and method names (fs, https, child_process, powershell, -NoP, .exe) and storing a download URL as a base64 literal. When decoded, the URL points to https://files.catbox.moe/9bppy2.zip, an anonymous and mutable file-hosting service unrelated to OpenZeppelin.
On Windows systems, the script downloads the ZIP file to %TEMP%, expands it using PowerShell's Expand-Archive cmdlet, recursively searches for the first .exe file in the extracted contents, and spawns it as a detached process. This results in arbitrary code execution with the privileges of the installing user or CI/CD system.
The attack vector is particularly dangerous because it executes automatically during npm install without requiring any user action, and the fetched executable is opaque attacker-controlled content from an untrusted source.
Indicators of compromise
- Packages
- @opezneppelin/contracts
- Domains
- catbox.moe
Remediation
- Immediately uninstall @opezneppelin/contracts from all systems and projects
- Use the legitimate @openzeppelin/contracts package instead
- Audit npm install logs and package-lock.json files to identify if @opezneppelin/contracts was ever installed
- On Windows systems where the package was installed, scan for suspicious executables in %TEMP% and check process execution logs
- Review npm account security and enable 2FA to prevent account takeover
- Consider using npm audit and supply chain security tools to detect typosquatting and malicious packages
- For CI/CD systems, implement package verification and restrict execution of postinstall scripts when possible
Sources
- GitHub Advisory GHSA-8hv2-jc3q-qpqj · GitHub Advisory Database
Cite this entry
"Malicious code in @opezneppelin/contracts (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-opezneppelin-contracts-npm-pn13tg
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package