Malicious code in timed-assess (npm)
The npm package timed-assess contained malicious code in its postinstall script that automatically executed arbitrary JavaScript on installation. The script decrypted a bundled payload using a hardcoded DES key and spawned a detached Node.js process to execute attacker-controlled code.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed timed-assess during the malicious period
- Ecosystems
- Attack vectors
- Affected entities
- timed-assessnpm package with malicious postinstall script
The timed-assess npm package contained a malicious postinstall hook that was triggered automatically during npm install. The package.json declared postinstall: node apps, which loaded apps/index.js.
The malicious script read a bundled encrypted file and decrypted it using CryptoJS.DES with a hardcoded key ('bf497c0b9cee'). The decrypted plaintext was then piped into the stdin of a detached Node.js process spawned with stdio redirection to suppress output, ensuring the attacker-controlled code executed silently on the installer's host.
The code used misleading identifiers and log strings (such as 'readLogoIco', 'rsa_exec', and 'ThetaSDK initialization error') to obscure its true purpose of executing arbitrary JavaScript. This obfuscation technique is typical of supply chain attacks designed to evade detection during code review.
The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- timed-assess
Remediation
- Immediately uninstall timed-assess from all systems
- Audit npm install logs and process history for evidence of unauthorized code execution during the malicious period
- Review and revoke any credentials or secrets that may have been exposed on affected systems
- Update npm to the latest version and run `npm audit` to identify other potentially compromised dependencies
- Consider using npm package signing verification and integrity checking tools to prevent similar attacks
Sources
- GitHub Advisory GHSA-pw97-8f4h-8j38 · GitHub Advisory Database
Cite this entry
"Malicious code in timed-assess (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-timed-assess-npm-fxurwh
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit