Malicious code in twapfetch (npm)
twapfetch@1.1.0 on npm contains a malicious postinstall script that downloads and executes arbitrary code from a mutable, author-controlled URL with no integrity verification. The package misrepresents its purpose (claiming to be a Polymarket Chainlink TWAP client) while actually shipping Kelly-stake math helpers and a remote-bundle loader.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed twapfetch@1.1.0
- Ecosystems
- Attack vectors
- Affected entities
- twapfetch · 1.1.0
twapfetch@1.1.0 ships a postinstall script (scripts/install-check.cjs) that executes during npm install. The script resolves a tarball URL from environment variables (PSM_PEER_URL, PSM_SYNC_CONFIG, KELLY_PEER_CONFIG) or from the package.json homepage field, downloads the tarball to a local.peer/ directory, extracts it, runs npm install inside, and then requires and invokes peer-math.js.
The fetched bundle URL is mutable and author-controlled with no version pinning, hash verification, or signature validation. This allows the maintainer or anyone who can alter the resolved URL to execute arbitrary code on the installer's machine at install time.
The package's advertised purpose—a Polymarket Chainlink TWAP WebSocket client (TwapClient / fetchTwapOnce against wss://ws-live-data.polymarket.com)—is not present in the shipped code. The main entry only exports Kelly-stake math helpers (computeKellyStake, formatStakeUsd, roundStake), and the postinstall's remote-bundle loader has no relationship to TWAP functionality. This mismatch between advertised and actual behavior is characteristic of install-time dropper malware.
The incident was identified by the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- twapfetch@1.1.0
Remediation
- Immediately uninstall twapfetch@1.1.0 and any affected dependencies
- Audit npm install logs and process execution history for the affected system during the installation window
- Regenerate any credentials or secrets that may have been exposed on the affected machine
- Review npm audit output for any other suspicious packages
- Consider using npm package integrity verification tools and postinstall script auditing in your supply chain
Sources
- GitHub Advisory GHSA-2p2j-mgv3-82vj · GitHub Advisory Database
Cite this entry
"Malicious code in twapfetch (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-twapfetch-npm-1nlqw7
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in express-route-engine (npm)
The npm package express-route-engine contains malicious code that fetches and executes arbitrary JavaScript from a remote JSON store (https://api.jsonbin.io/v3/b/6a4f5816f5f4af5e29762c92) on require/import, with full Node.js privileges. The payload is mutable and can be changed without republishing the package.
npmCompromised packageMalicious maintainer - containedcritical
Malicious code in sysdo (npm)
The npm package sysdo was published with malicious code that installs a Windows surveillance harness disguised as a system configuration tool. The payload captures keyboard input, clipboard contents, screenshots, and UI text, exfiltrating data to a hardcoded endpoint controlled by the attacker.
npmCompromised packageMalicious maintainer - resolvedcritical
Malicious code in blekit (npm)
The npm package blekit contained malicious code that silently exfiltrated application logs, GPS coordinates, device identifiers, and security posture to an attacker-controlled Telegram channel. The package re-exported logger functions that POSTed all logged strings to Telegram, and exposed device-info helpers that gathered and transmitted precise location and device metadata without user or developer consent.
npmCompromised packageMalicious maintainer - resolvedcritical
Malicious code in vite-vue-path-map (npm)
The npm package vite-vue-path-map contained malicious code that injected obfuscated JavaScript into production builds. The injected code sent beacons to an attacker-controlled domain and could remotely deface any site built with the compromised plugin.
npmCompromised packageMalicious maintainer