Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
- Disclosed
- Last updated
- Blast radius
- Any process importing @syncraft-labs/core via ESM entry point; arbitrary remote code execution with full Node.js capabilities on installer host
- Ecosystems
- Attack vectors
- Affected entities
- @syncraft-labs/coreESM build at dist/index.js contains obfuscated malicious payload
The npm package @syncraft-labs/core was found to contain malicious code injected into its ESM build (dist/index.js). The payload is heavily obfuscated using an obfuscator.io-style tool with hex-identifier string arrays and a rotator function.\n\nThe malicious code executes automatically on every import or require of the package. It captures Node.js internals onto the global object (globalThis.r = require, globalThis.m = module, globalThis.i = "A12-synd"), then uses HTTP/HTTPS to query multiple Ethereum JSON-RPC endpoints (eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blockscout.com) and Etherscan-style transaction list APIs for a hardcoded attacker address (0xa322E5f3...). The code decodes and decompresses payload bytes from blockchain transaction data and executes them via child_process.spawn.\n\nThe CommonJS build of the same package was found to be clean, indicating this was a targeted injection into the ESM entry point rather than a bundler artifact. Any process importing this package would fetch attacker-controlled code from a mutable on-chain dead-drop and execute it with full Node.js capabilities, giving the attacker arbitrary remote code execution on the installer's host.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @syncraft-labs/core
- Domains
- eth.drpc.org
- ethereum-rpc.publicnode.com
- eth-mainnet.public.blockscout.com
- Hashes
- 0efe219063a966d0d2025d6c3274cbc7e9f3c0b3a1e9cdf81c7adf6dbae4d4ac
Remediation
- Immediately remove @syncraft-labs/core from all dependencies and lock files
- Audit all systems that imported this package for signs of compromise or unauthorized code execution
- Review Node.js process logs and network traffic for connections to the identified Ethereum RPC endpoints
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Use npm audit to identify any transitive dependencies on @syncraft-labs/core
- Consider using supply chain security tools to detect similar obfuscated payloads in other packages
Sources
- GitHub Advisory GHSA-54xx-8x72-3539 · GitHub Advisory Database
Cite this entry
"Malicious code in @syncraft-labs/core (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 23, 2026; last updated August 23, 2026. https://supplychainattack.org/incident/malicious-code-in-syncraft-labs-core-npm-0lz8ib
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in ranux-pro (npm)
The npm package ranux-pro contained malicious code disguised as a network socket library. The package shipped a multi-tenant WhatsApp bot with obfuscated code and a mutable dependency override pointing to a personal GitHub account, allowing attackers to execute arbitrary code at install and runtime.
npmCompromised packageMalicious commit - containedcritical
Malicious code in dxrs-dos (npm)
The npm package dxrs-dos is an openly-advertised DDoS/booter toolkit that executes malicious code on module load. It uses an unpinned dependency (deathoffather-project) for arbitrary code execution and extracts a password-protected PHP C2 panel archive into the caller's working directory.
npmCompromised packageMalicious commit