Malicious code in truffle-helper (npm)
The npm package truffle-helper version 2.0.0 contains malicious code that executes arbitrary commands during installation via npm lifecycle scripts, fetching and executing remote content without user consent.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system installing truffle-helper via npm
- Ecosystems
- Attack vectors
- Affected entities
- truffle-helper · 2.0.0
The npm package truffle-helper version 2.0.0 was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project. The package's package.json file contains code that invokes require('child_process') and executes curl commands via execSync() in an npm lifecycle script.
When a developer runs npm install truffle-helper, the malicious lifecycle script automatically executes, causing the installer's machine to fetch and execute remote content without user consent or any integrity verification. This occurs at install time before the package is even used.
The declared purpose of truffle-helper (a Truffle helper utility) has no legitimate reason to execute shell commands or fetch remote content during installation. Any system running npm install truffle-helper executes attacker-controlled commands on the host machine.
The malicious package was identified and cataloged by the OpenSSF malicious packages repository (MAL-2026-3716).
Indicators of compromise
- Packages
- truffle-helper@2.0.0
Remediation
- Immediately uninstall truffle-helper from all systems: npm uninstall truffle-helper
- Audit npm install logs and package-lock.json to identify when the malicious package was installed
- Review system logs on any machine that installed this package for evidence of unauthorized command execution
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Use npm audit to check for other malicious packages
- Consider using npm package integrity verification tools and private package registries to prevent similar incidents
Sources
- GitHub Advisory GHSA-2cq2-c7vh-j55c · GitHub Advisory Database
Cite this entry
"Malicious code in truffle-helper (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-truffle-helper-npm-9ki4vg
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @vaultflow/create-flow
Malware discovered in the npm package @vaultflow/create-flow. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in @vaultflow/update-flow
Malware was discovered in the npm package @vaultflow/update-flow. Systems with this package installed or running are considered fully compromised, with potential for complete system takeover.
npmCompromised package - resolvedcritical
Malicious code in tempo-components (npm)
The npm package tempo-components contained malicious code (poc.js) that collected host metadata and identity information and exfiltrated it to an external endpoint. The package performed system reconnaissance by capturing hostname, platform, and user identity before transmitting the data via HTTPS.
npmCompromised package - containedcritical
Malicious code in @antv/g-webgl-compute (npm)
The npm account `atool` was compromised and used to publish 631 malicious versions across 314 npm packages, including @antv/g-webgl-compute, as part of the "Mini Shai-Hulud" supply chain attack campaign. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
Mini Shai HuludnpmOtherAccount takeoverCompromised packageMalicious commit