Malicious code in truffle-js (npm)
The npm package truffle-js (version 2.0.0) contained malicious code that executed arbitrary remote content via curl during installation. The package name resembles the legitimate 'truffle' Ethereum toolkit, consistent with a typosquatting attack.
- Disclosed
- Last updated
- Blast radius
- Any developer or system running `npm install` with truffle-js as a dependency.
- Ecosystems
- Attack vectors
- Affected entities
- truffle-js · 2.0.0
The npm package truffle-js version 2.0.0 was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project. The package contained a malicious install-time lifecycle script that invoked require('child_process').execSync with a curl command to fetch and execute remote content without user consent.
The attack vector exploited npm's lifecycle hooks, which execute during package installation. By using curl to fetch content from the network during the install phase, the malicious package could execute arbitrary code on any system running npm install with this package as a dependency.
The package name 'truffle-js' was chosen to resemble the widely-used 'truffle' Ethereum development toolkit, a classic typosquatting lure designed to trick developers into installing the wrong package. There is no legitimate reason for a utility package to shell out to curl from its package.json install hook.
The incident has been identified and documented by the OpenSSF malicious packages repository, allowing the npm ecosystem to take action against the malicious package.
Indicators of compromise
- Packages
- truffle-js@2.0.0
Remediation
- Remove truffle-js from all package.json files and dependencies
- Audit npm install logs and system activity during the time the package was installed to detect any unauthorized changes
- Use the legitimate 'truffle' package instead if Ethereum development toolkit functionality is needed
- Enable npm audit to detect known malicious packages
- Consider using npm's `--ignore-scripts` flag during installation if you must install untrusted packages
- Review and revoke any credentials or access tokens that may have been exposed on systems where truffle-js was installed
Sources
- GitHub Advisory GHSA-7cmq-x9fp-ppg5 · GitHub Advisory Database
Cite this entry
"Malicious code in truffle-js (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-truffle-js-npm-1k1h6l
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting - containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package - containedcritical
Malicious code in typography-stylecss (npm)
The npm package typography-stylecss is a typosquatting attack impersonating the legitimate @tailwindcss/typography plugin. It contains obfuscated malicious code that downloads and executes a platform-specific binary when the module is imported, triggered automatically during Tailwind config loading.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package