Malicious code in secp256k1-lib (npm)
The npm package secp256k1-lib is a typosquatting attack masquerading as the legitimate secp256k1 cryptography library. It contains obfuscated malicious code that executes on require() and attempts to make HTTP requests to a hidden destination, consistent with credential or wallet-stealing behavior.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation count and whether the hidden HTTP destination was activated.
- Ecosystems
- Attack vectors
- Affected entities
- secp256k1-libnpm package; typosquatting attack mimicking secp256k1
The npm package secp256k1-lib is a malicious package that mimics the widely-used secp256k1 cryptographic library through name confusion. The package contains no legitimate cryptographic functionality.
The package's main entry point (index.js) is a 33KB obfuscated bundle created with obfuscator.io. The obfuscated code contains only readable tokens for require() and axios, with all other strings (including target hostnames, URLs, and function names) hex-escaped and stored in a runtime-reconstructed string array. The package description ("logger tool for validation entry") does not match a secp256k1 implementation, and the README is only 24 bytes.
Upon require('secp256k1-lib'), the obfuscated bundle executes immediately and instantiates an HTTP client (axios) targeting a runtime-constructed destination that could not be recovered from the shipped bytes. The attack pattern—name confusion with a high-value crypto package, absence of legitimate functionality, and obfuscated import-time network capability with a hidden destination—is consistent with credential or wallet-stealing malware.
The package was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-w987-xfx4-xq5v.
Indicators of compromise
- Packages
- secp256k1-lib
Remediation
- Remove secp256k1-lib from all dependencies immediately
- Audit package.json and lock files for any installation of secp256k1-lib
- Use the legitimate secp256k1 package instead (verify the correct package name and maintainer)
- If secp256k1-lib was installed, assume compromise: rotate any credentials or private keys that may have been exposed
- Review npm audit and dependency scanning tools to catch typosquatting attacks
- Monitor for suspicious outbound HTTP connections from systems where secp256k1-lib was installed
Sources
- GitHub Advisory GHSA-w987-xfx4-xq5v · GitHub Advisory Database
Cite this entry
"Malicious code in secp256k1-lib (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-secp256k1-lib-npm-qu81mg
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package