Malicious code in seekcode (npm)
The seekcode npm package contains malicious code that redirects users selecting the deepseek-cn provider to a typosquatted domain (api.deepseeki.com instead of api.deepseek.com), exfiltrating API credentials and chat prompt contents to an attacker-controlled server.
- Disclosed
- Last updated
- Blast radius
- All users of the seekcode npm package who select the deepseek-cn provider will have their DeepSeek API credentials and chat prompt contents exfiltrated to an attacker-controlled domain.
- Ecosystems
- Attack vectors
- Affected entities
- seekcodenpm package containing malicious code in the defaultBaseUrlForProvider function
The seekcode npm package was found to contain intentional malicious code in its defaultBaseUrlForProvider function (located in dist/chunk-6U42R724.js). When users select the advertised deepseek-cn provider, the function returns https://api.deepseeki.com — a one-character typosquat of the legitimate DeepSeek endpoint api.deepseek.com.\n\nAll other provider branches in the same switch statement correctly return their official endpoints (api.deepseek.com, integrate.api.nvidia.com, openrouter.ai, etc.), making this deviation intentional rather than accidental. The asymmetry strongly indicates deliberate malicious intent: a random typo would be unlikely to consistently land on a lookalike domain while all sibling cases remain correct.\n\nAny user invoking the deepseek-cn provider will send their DeepSeek API bearer token and the full content of every chat prompt to the attacker-controlled domain. This represents a critical credential and data exfiltration risk, as chat prompts routinely contain private code, secrets, and proprietary data when used through coding assistants.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages project.
Indicators of compromise
- Domains
- api.deepseeki.com
Remediation
- Immediately remove or update the seekcode package to a patched version that corrects the deepseek-cn provider endpoint to the legitimate api.deepseek.com
- Audit npm package dependencies for seekcode and remove it if not actively maintained or if no patched version is available
- If seekcode was used with the deepseek-cn provider, rotate all DeepSeek API credentials immediately
- Review chat history and prompts sent through seekcode for any sensitive data exposure
- Monitor the attacker-controlled domain (api.deepseeki.com) for evidence of credential or data exfiltration
Sources
- GitHub Advisory GHSA-xj6w-x4p9-6r73 · GitHub Advisory Database
Cite this entry
"Malicious code in seekcode (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-seekcode-npm-buk7v1
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in cheerio-tool (npm)
cheerio-tool, a typosquatting package on npm impersonating the popular cheerio HTML parser, contained malicious postinstall code that harvested npm credentials, API keys, cloud credentials, and cryptocurrency wallet data from infected systems.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting - containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package