Malicious code in prediction-trader (npm)
The npm package prediction-trader contains malicious code that contacts a hardcoded IP endpoint (31.97.137.157:45000) to retrieve and execute arbitrary JavaScript with full Node.js capabilities. The package masquerades as a trading library while leveraging dependencies associated with wallet and credential theft.
- Disclosed
- Last updated
- Blast radius
- Any consumer of the prediction-trader npm package that invokes the default export
- Ecosystems
- Attack vectors
- Affected entities
- prediction-tradernpm package containing malicious code in index.js
The npm package prediction-trader was found to contain malicious code in its index.js file. The code disguises itself as a CDN/icon fetch operation, contacting a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/108 with a fake bearer token header. The endpoint returns a JSON response whose credits field is passed directly into a dynamically constructed JavaScript function with full Node.js capabilities (require, module, process, Buffer, globals), allowing arbitrary code execution.
The package's declared dependencies—node-machine-id, @primno/dpapi, and better-sqlite3—are consistent with wallet and browser-cookie stealer tooling, providing primitives for the remotely fetched malicious code to leverage. The package's README describes a benign trading library, but the actual code contains unused references to CDN decoy domains (cdnjs/cloudflare), indicating intentional obfuscation.
Any consumer that loads the package and invokes its default export will execute attacker-controlled code delivered from the remote endpoint. The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- prediction-trader
- IPs
- 31.97.137.157
Remediation
- Immediately remove the prediction-trader package from all projects and dependencies
- Audit all systems that installed or ran prediction-trader for signs of compromise (credential theft, wallet access, browser cookie exfiltration)
- Review process and network logs for connections to 31.97.137.157:45000
- Rotate all credentials and secrets that may have been exposed
- Consider the package compromised; do not update to newer versions without verification from the maintainer
- Use npm audit to identify any transitive dependencies on this package
Sources
- GitHub Advisory GHSA-g7gf-2m6j-5f6q · GitHub Advisory Database
Cite this entry
"Malicious code in prediction-trader (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-prediction-trader-npm-bt5upf
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit