Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in rimraf-utils (npm)

rimraf-utils@1.0.5 on npm contains malicious code that impersonates the legitimate rimraf package. The postinstall script harvests sensitive credentials (npm tokens, API keys, crypto wallet seeds, private keys) and exfiltrates them to a hardcoded C2 server at 149.28.127.35:8888 over plaintext HTTP.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Global; affects any developer who installed rimraf-utils@1.0.5 via npm install. Potential impact on downstream projects and CI/CD pipelines.
Ecosystems
npm
Attack vectors
Compromised packageTyposquatting
Affected entities
  • rimraf-utils · 1.0.5

rimraf-utils@1.0.5 is a typosquatting attack targeting the widely-used rimraf package. The malicious package contains a dummy index.js that identifies itself as a placeholder module, with the actual payload in postinstall.js.

Upon installation, the postinstall script executes automatically and performs extensive credential harvesting: it reads ~/.npmrc (npm authentication tokens), ~/.env (API keys, database URLs, cloud credentials, payment keys, EVM private keys, webhooks), and ~/.git-credentials. It also collects system metadata including hostname and user information.

The script enumerates 71 hardcoded cryptocurrency wallet extension IDs across Chrome, Brave, Edge, and Firefox (including MetaMask, Phantom, Coinbase, Trust, Exodus, Ledger Live, Trezor, and Solflare), then reads LevelDB .log files from wallet profile directories to extract vault data, seeds, mnemonics, private keys, and encrypted passwords. It additionally performs recursive filesystem walks of ~/Documents, ~/Desktop, ~/Downloads, ~/OneDrive, ~/Dropbox, ~/Google Drive, and backup/keys/wallet/crypto subdirectories searching for seed phrases and private key patterns.

All harvested data is aggregated into a JSON payload and exfiltrated via HTTP POST to http://149.28.127.35:8888, with the C2 URL overridable via the C2_URL environment variable.

Indicators of compromise

Packages
  • rimraf-utils@1.0.5
IPs
  • 149.28.127.35

Remediation

  • Immediately uninstall rimraf-utils@1.0.5 and any affected versions from all systems and CI/CD pipelines
  • Audit npm install logs to identify when and where rimraf-utils was installed
  • Rotate all npm authentication tokens stored in ~/.npmrc
  • Rotate all API keys, database credentials, and cloud credentials referenced in ~/.env files
  • Revoke or rotate any cryptocurrency wallet seeds, private keys, or mnemonics that may have been exposed
  • Review git credentials and rotate any exposed authentication tokens
  • Monitor the C2 IP address (149.28.127.35:8888) for data exfiltration and block at network perimeter
  • Use npm audit to identify and remediate any downstream dependencies that may have pulled in this malicious package
  • Consider implementing package signature verification and allowlisting for npm dependencies in CI/CD pipelines

Sources

  1. GitHub Advisory GHSA-9fg9-r489-hq34 · GitHub Advisory Database

Cite this entry

"Malicious code in rimraf-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-rimraf-utils-npm-frhkj1

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in exxpress-utils (npm)

    The npm package exxpress-utils contained malicious code in a postinstall script that harvested npm/AWS/GitHub credentials, scanned for cryptocurrency wallet extensions, and exfiltrated sensitive files to a hardcoded C2 server. The package was a typosquat of the legitimate 'express' package.

    npmCompromised packageTyposquatting
  2. containedcritical

    Malicious code in hardhat-core (npm)

    The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.

    npmTyposquattingCompromised package
  3. containedcritical

    Malicious code in prisma-callback (npm)

    prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.

    npmTyposquattingCompromised package
  4. resolvedcritical

    Malicious code in prettier-lint-lenz (npm)

    The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.

    npmCompromised packageTyposquatting