Malicious code in web3-core-js (npm)
The npm package web3-core-js (version 2.0.0) contained malicious code that executed arbitrary remote commands during installation. The package mimicked the legitimate web3/web3-core ecosystem but contained only a lifecycle hook that fetched and executed attacker-controlled code via curl.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI system that ran `npm install web3-core-js`
- Ecosystems
- Attack vectors
- Affected entities
- web3-core-js · 2.0.0
The npm package web3-core-js version 2.0.0 was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project. The package name was designed to mimic the widely-used web3/web3-core ecosystem, creating a typosquatting attack vector.
The malicious payload was embedded in a package.json lifecycle hook that invoked require('child_process') and execSync with a curl command. This hook executed automatically during npm install, before any user code ran, fetching and executing remote content on the installer's machine with the privileges of the installing user.
The package contained no legitimate library code consistent with its claimed web3 purpose—it was purely a delivery mechanism for remote code execution. Any developer or CI system that ran npm install web3-core-js would have executed arbitrary attacker-controlled code.
The incident was identified and reported through the OpenSSF malicious packages database (MAL-2026-3719) and subsequently disclosed via GitHub Security Advisories.
Indicators of compromise
- Packages
- web3-core-js@2.0.0
- Hashes
- 46f9612aaab12b9656a1f1b5fbd7684fdcd57833bbf76d14b2a243f679cb0977
- 44e1f40536600c94540b0fd722439856b2f118f6090709db7461f5aa06fc2fb4
Remediation
- Immediately uninstall web3-core-js from all affected systems
- Audit npm install logs and CI/CD pipelines for execution of web3-core-js between publication and removal
- Assume any machine that installed this package may be compromised; review for unauthorized access or lateral movement
- Use the legitimate web3.js package (from the web3 organization) instead
- Enable npm package verification and consider using npm audit to detect similar malicious packages
- Review npm package names carefully before installation to avoid typosquatting attacks
Sources
- GitHub Advisory GHSA-f75h-gv5f-cg2x · GitHub Advisory Database
Cite this entry
"Malicious code in web3-core-js (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-web3-core-js-npm-4849f9
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in exxpress-utils (npm)
The npm package exxpress-utils contained malicious code in a postinstall script that harvested npm/AWS/GitHub credentials, scanned for cryptocurrency wallet extensions, and exfiltrated sensitive files to a hardcoded C2 server. The package was a typosquat of the legitimate 'express' package.
npmCompromised packageTyposquatting - containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting