Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
- Disclosed
- Last updated
- Blast radius
- Downstream applications using @syncraft-labs/react with the malicious ESM entry point; affects Node.js build/SSR contexts and browser bundles of consumers.
- Ecosystems
- Attack vectors
- Affected entities
- @syncraft-labs/reactMalicious code in dist/index.js (ESM entry point); absent from dist/index.cjs and TypeScript sources
The npm package @syncraft-labs/react was found to contain malicious code in its ESM distribution file (dist/index.js). The obfuscated payload uses obfuscator.io-style identifiers and a rotated string array decoder injected into the useEffect body of the useSync hook.\n\nThe malicious code captures Node.js require and module globals, then uses http/https and zlib (createInflate/createBrotli) to fetch data from multiple Ethereum RPC endpoints (h.drpc.org, 1rpc.io/eth), Blockscout, and Etherscan. It queries a hardcoded smart contract address (0xa322E5f3...) and reconstructs JavaScript code from on-chain bytes, executing it with full require access.\n\nThis implements the EtherHiding pattern, where a mutable smart contract allows operators to deliver arbitrary JavaScript to all downstream consumers that render components using useSync. This achieves remote code execution in Node.js build and server-side rendering contexts, as well as in the browser bundles of affected applications.\n\nThe obfuscated code is absent from the CommonJS distribution (dist/index.cjs) and from TypeScript sources referenced by the source map (dist/index.js.map), indicating the ESM artifact was tampered with after the build process completed. The incident was credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @syncraft-labs/react
- Domains
- h.drpc.org
- 1rpc.io
- etherscan.io
- blockscout.com
Remediation
- Immediately remove @syncraft-labs/react from all projects and dependencies
- Audit build logs and artifacts for any suspicious activity or unexpected code execution during builds
- Review and rotate any credentials or secrets that may have been exposed during the build or runtime of affected applications
- Scan downstream applications for signs of unauthorized code execution or data exfiltration
- Update to a patched version once the maintainers have addressed the root cause and verified the integrity of the distribution
- Consider using package integrity verification tools and lock files to detect tampering
Sources
- GitHub Advisory GHSA-83j7-x5xf-qxwq · GitHub Advisory Database
Cite this entry
"Malicious code in @syncraft-labs/react (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 23, 2026; last updated August 23, 2026. https://supplychainattack.org/incident/malicious-code-in-syncraft-labs-react-npm-b3ervp
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - containedcritical
Malware in hydration-dim-kit
Malware was discovered in the npm package hydration-dim-kit. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in @sdgdfgdfhhhfd/chainvista
Malware discovered in the npm package @sdgdfgdfhhhfd/chainvista. Any computer with this package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different system.
npmCompromised package