Malicious code in @wizloft/harness (npm)
The npm package @wizloft/harness contained obfuscated malicious code that implements an on-chain command-and-control (C2) dropper pattern. On import, the code queries an Ethereum smart contract via public RPC endpoints to retrieve and execute arbitrary payloads via eval(), enabling remote code execution in the installer's Node process.
- Disclosed
- Last updated
- Blast radius
- All npm consumers of @wizloft/harness who installed the malicious version(s)
- Ecosystems
- Attack vectors
- Affected entities
- @wizloft/harnessnpm package containing malicious code in dist/index.js
The @wizloft/harness npm package shipped with malicious code embedded in its main entrypoint dist/index.js. The file contained approximately 200 lines of legitimate TypeScript-compiled SDK facade code followed by a ~40KB obfuscated payload generated by obfuscator.io, featuring a 303-entry rotated string array and control-flow variables.\n\nDeobfuscation revealed the malicious payload implements the EtherHiding on-chain-C2 dropper pattern. The code contains hardcoded references to public Ethereum RPC endpoints (eth.drpc.org, 1rpc.io), an etherscan-style API query interface, a hardcoded Ethereum contract address (0xa322E5f3...), a spoofed Mozilla/5.0 User-Agent, and JSON POST machinery. The sinks include require, pipe, and eval.\n\nOn package import, the code queries the attacker-controlled smart contract via public Ethereum RPC to retrieve a next-stage payload string, then passes it directly to eval() in the consumer's Node process. This yields arbitrary remote code execution against any system that installed the package. The on-chain payload storage is mutable by the contract owner, making it immune to registry takedown and invisible to standard registry scanners.\n\nThe package README falsely claimed 'no executable binary,' contradicting the shipped dist/index.js. The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @wizloft/harness
- Domains
- eth.drpc.org
- 1rpc.io
- Hashes
- 3679ede1e874f59f4be963544c3df43069cd335b2f888753b7411e42c7a5d3dd
Remediation
- Immediately uninstall @wizloft/harness from all systems and projects
- Audit npm install logs to identify all systems that installed this package
- Assume any system that installed @wizloft/harness has been compromised; perform forensic analysis and credential rotation
- Review Node process logs and network traffic for signs of malicious payload execution or exfiltration
- Update npm lockfiles and reinstall dependencies from a clean state, excluding @wizloft/harness
- Monitor for similar obfuscated payloads in other dependencies using static analysis tools
- Report any observed malicious activity to your security team and relevant authorities
Sources
- GitHub Advisory GHSA-7m5m-mvp3-wwrq · GitHub Advisory Database
Cite this entry
"Malicious code in @wizloft/harness (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-wizloft-harness-npm-9shn2g
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package