Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
- Disclosed
- Last updated
- Blast radius
- Any application importing @syncraft-labs/vue@0.4.1 via ESM module entry point
- Ecosystems
- Attack vectors
- Affected entities
- @syncraft-labs/vue · 0.4.1
The ESM build (dist/index.js) of @syncraft-labs/vue@0.4.1 contains heavily obfuscated malicious payload injected alongside legitimate Vue plugin source code. The obfuscation uses an obfuscator.io-style rotating string array with 303 entries and opaque predicates to conceal a loader.
The loader requires Node.js modules (http, https, zlib, child_process) and queries Ethereum RPC endpoints (publicnode.com/ethereum-rpc, drpc.org/eth, blockscout) and Etherscan-style transaction list endpoints for a hardcoded Ethereum address (0xa322E5f3...). It decodes base64/gzip content from returned transaction data and passes it to child_process.spawn for execution.
This implements the EtherHiding blockchain-hosted command-and-control dropper pattern: any consumer importing @syncraft-labs/vue via ESM resolves an attacker-controlled runtime payload from Ethereum transactions and executes it, yielding remote code execution. The CommonJS build and sourcemap are clean, indicating the ESM artifact was tampered with post-build to smuggle the loader while preserving legitimate exports.
The vulnerability was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @syncraft-labs/vue@0.4.1
- Domains
- publicnode.com
- drpc.org
- blockscout
Remediation
- Immediately remove @syncraft-labs/vue@0.4.1 from all dependencies
- Audit all applications that imported this package version for signs of compromise or unauthorized code execution
- Use only verified, unaffected versions of @syncraft-labs/vue if the package is still needed
- Review npm audit logs and lock files to identify when this version was installed
- Consider using npm package integrity verification and supply chain security tools to detect similar tampering
Sources
- GitHub Advisory GHSA-9cqm-9mxm-f9gh · GitHub Advisory Database
Cite this entry
"Malicious code in @syncraft-labs/vue (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 23, 2026; last updated August 23, 2026. https://supplychainattack.org/incident/malicious-code-in-syncraft-labs-vue-npm-1aunnk
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malware in hydration-dim-kit
Malware was discovered in the npm package hydration-dim-kit. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package