Malicious code in @wizloft/harness-kernel (npm)
The npm package @wizloft/harness-kernel contained obfuscated malicious code in dist/index.js that executes on import, fetching and executing arbitrary JavaScript payloads via on-chain C2 infrastructure. The malware queries Ethereum JSON-RPC endpoints to retrieve command-and-control addresses and downloads XOR-encrypted payloads for remote code execution.
- Disclosed
- Last updated
- Blast radius
- All npm consumers of @wizloft/harness-kernel
- Ecosystems
- Attack vectors
- Affected entities
- @wizloft/harness-kernel
The npm package @wizloft/harness-kernel was found to contain malicious code embedded in dist/index.js. The malware is disguised using obfuscator.io-style transforms including hex identifiers, string array rotation, and control-flow flattening to conceal its true functionality.
Upon import, the code executes an obfuscated top-level async IIFE that queries multiple Ethereum JSON-RPC endpoints (eth.drpc.org, eth.publicnode.com, ethereum-rpc.publicnode.com, and an Etherscan-like API) for transactions from a hardcoded marker address. The transaction data is parsed to extract two IPv4 addresses, which are then used to construct URLs for fetching XOR-encrypted payloads.
The malware downloads encrypted payloads from constructed HTTP endpoints, decrypts them using XOR, and executes the resulting JavaScript via both eval() and detached Node.js processes spawned with the -e flag. This architecture allows the attacker to maintain mutable, takedown-resistant command-and-control through on-chain data, with payload contents remaining opaque and fully attacker-controlled.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @wizloft/harness-kernel
- Domains
- eth.drpc.org
- eth.publicnode.com
- ethereum-rpc.publicnode.com
Remediation
- Immediately remove @wizloft/harness-kernel from all dependencies and lock files
- Audit all systems that installed this package for signs of compromise, including process execution logs and network connections
- Review Ethereum transaction history from the hardcoded marker address (0xa322E5f39aDC2490Ef6f0121063e358050D311D3080e) to identify potential payload delivery dates
- Monitor for unexpected outbound HTTP connections to the identified C2 infrastructure
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update npm dependencies to remove this package and verify no transitive dependencies pull it in
Sources
- GitHub Advisory GHSA-jjpx-9cx9-ww85 · GitHub Advisory Database
Cite this entry
"Malicious code in @wizloft/harness-kernel (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-wizloft-harness-kernel-npm-qs6fc1
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package