Malicious code in @sarex-team/translator (npm)
The npm package @sarex-team/translator contained malicious code in its install lifecycle script that exfiltrated installer identity (username, hostname, working directory) via DNS queries to an attacker-controlled domain (oob.sl4x0.xyz). The exfiltration logic was obfuscated using hex-named files with runtime character-code reconstruction.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed @sarex-team/translator
- Ecosystems
- Attack vectors
- Affected entities
- @sarex-team/translator
The npm package @sarex-team/translator was published with malicious code embedded in its install lifecycle script. Upon installation, the package automatically executes node index.js, which loads lib/core.js and performs reconnaissance on the installer's environment.
The malicious module collects the installer's username, hostname, and current working directory basename, concatenates them with a timestamp, and encodes this information as DNS subdomain labels. It then performs a DNS resolution query against oob.sl4x0.xyz, an authoritative nameserver controlled by the attacker. This technique allows the attacker to log the identity and environment of every user who installs the package.
To evade detection, the exfiltration logic is obfuscated: the module names ('os', 'dns', 'process') and accessor names ('userInfo', 'hostname', 'cwd') are reconstructed at runtime from character-code arrays stored in hex-named files (lib/b02e30.js, lib/6ad264.js). The destination domain sl4x0.xyz matches the package author's contact email (research@sl4x0.xyz), confirming the attacker's control.
The incident was identified and reported by the OpenSSF's malicious-packages project.
Indicators of compromise
- Packages
- @sarex-team/translator
- Domains
- oob.sl4x0.xyz
- sl4x0.xyz
Remediation
- Immediately uninstall @sarex-team/translator from all systems
- Audit npm install logs to identify when the package was installed and on which machines
- Assume any system that installed this package has been compromised; review for unauthorized access or lateral movement
- Change credentials (passwords, SSH keys, API tokens) on affected systems
- Monitor DNS logs for queries to oob.sl4x0.xyz or related domains
- Review npm audit and dependency trees to identify if @sarex-team/translator was a transitive dependency
- Consider using npm package integrity verification tools to detect similar obfuscated malicious code in the future
Sources
- GitHub Advisory GHSA-fmc2-rvc8-p88c · GitHub Advisory Database
Cite this entry
"Malicious code in @sarex-team/translator (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-sarex-team-translator-npm-1t1699
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package