Malicious code in permit2 (npm)
The npm package "permit2" is a typosquatting attack impersonating Uniswap's legitimate Permit2 token-approval system (@uniswap/permit2-sdk). It contains malicious install-time payload that exfiltrates environment variables and credential files to an attacker-controlled webhook.site endpoint.
- Disclosed
- Last updated
- Blast radius
- Developers installing the malicious permit2 package; any systems where the package was installed with environment variables or credential files present.
- Ecosystems
- Attack vectors
- Threat actor
- Affected entities
- permit2Malicious npm package typosquatting the legitimate @uniswap/permit2-sdk
The malicious npm package "permit2" squats on the bare name of Uniswap's Permit2 token-approval system, whose legitimate distribution is the scoped package @uniswap/permit2-sdk. The package falsely advertises itself as a "smart contract development toolkit" but contains no real functionality.
The published tarball includes only a package.json and an install-time payload (index.js) that executes automatically via both preinstall and postinstall hooks when running npm install. The payload is a variant of an infostealer used in the mssjeep843 DeFi-impersonation campaign and exfiltrates data to the same webhook.site endpoint.
The malicious code collects environment variables matching a broad secret pattern (KEY, TOKEN, SECRET, PASS, PRIVATE, MNEMONIC, RPC, AWS, GITHUB, NPM, KUBE, VAULT, AUTH, PGP, GPG, SEED, WALLET, BEARER, API, INFURA, ALCHEMY, HELIUS, QUICKNODE, ANKR, PRIVATE_KEY) and reads and exfiltrates the full contents of credential and key files including ~/.aws/credentials, ~/.aws/config, SSH keys, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.pypirc, ~/.gitconfig, GCP credentials, Solana/Anchor keypairs, NEAR credentials, Sui keystore, and Foundry keystore files.
Indicators of compromise
- Packages
- permit2
- Domains
- webhook.site
Remediation
- Immediately uninstall the permit2 npm package from all systems
- Use the legitimate @uniswap/permit2-sdk scoped package instead
- Rotate all credentials and secrets that may have been exposed (AWS keys, SSH keys, GitHub tokens, NPM tokens, Kubernetes configs, Docker configs, etc.)
- Audit npm install logs and package-lock.json files to identify systems where permit2 was installed
- Review webhook.site logs if accessible to determine what data was exfiltrated
- Implement npm package name verification and use scoped packages where available
- Consider using npm audit and supply chain security tools to detect typosquatting attacks
Sources
- GitHub Advisory GHSA-5hx7-m92r-hc5c · GitHub Advisory Database
Cite this entry
"Malicious code in permit2 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-permit2-npm-ckm07q
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - containedcritical
Malicious code in @polymarkets/clob-client-v2 (npm)
@polymarkets/clob-client-v2 (npm) is a malicious package that typosquats the legitimate @polymarket scope and redirects its inquirer dependency to a lookalike npm registry (registrynpmjs.to) to deliver arbitrary code execution during installation and on first require.
npmTyposquattingCompromised packageDependency confusion