Malicious code in supersig (npm)
The supersig npm package contains malicious code in its published dist bundles (dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js) that is absent from the source tree. The bundles execute a decrypt-and-execute chain at load time using a DES key from an unpinned mkb-manager dependency, allowing remote code execution on any consumer.
- Disclosed
- Last updated
- Blast radius
- Any consumer of the supersig npm package that requires or imports it will execute the malicious decrypted payload at load time.
- Ecosystems
- Attack vectors
- Affected entities
- supersignpm package with malicious code in dist bundles
The supersig npm package contains a decrypt-and-execute payload embedded in its published distribution bundles (dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js). This malicious code is not present in the src/ tree, indicating deliberate concealment from source-code review.
The bundles import a DES decryption key from an unpinned mkb-manager@latest dependency, decrypt an embedded encrypted token to produce plaintext code, and execute it by spawning a child node process via child_process.spawn('node', []) and writing the decrypted bytes to its stdin. This payload executes automatically when the package is required or imported.
Because mkb-manager is pinned to latest rather than a specific version, whoever controls that package can rotate the decryption key and payload at will, making the executed code opaque and mutable. The src/ modules (wallet, signers, providers, transactions) contain no decryptToken, readRSAFromPackage, mkb-manager, or child_process usage, confirming the dropper is present only in the shipped bundles.
The incident was identified by the OpenSSF malicious-packages project and published as MAL-2026-13461.
Indicators of compromise
- Packages
- supersig
- mkb-manager
Remediation
- Immediately remove or uninstall the supersig package from all environments
- Audit all systems that have installed supersig for signs of compromise or unauthorized code execution
- Review and revoke any credentials or secrets that may have been exposed on affected systems
- Do not upgrade to newer versions of supersig until the package is confirmed clean by the maintainers
- Monitor the mkb-manager package for suspicious activity or unauthorized updates
Sources
- GitHub Advisory GHSA-3g8f-pfg5-95hv · GitHub Advisory Database
Cite this entry
"Malicious code in supersig (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-supersig-npm-uxvtrj
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit