Malicious code in @wizloft/harness-validation (npm)
The npm package @wizloft/harness-validation and sibling packages contain obfuscated malicious code that executes on import. The payload implements a blockchain-based dead-drop mechanism using Ethereum transactions to fetch and execute arbitrary code, allowing the attacker to remotely update the delivered payload.
- Disclosed
- Last updated
- Blast radius
- Any process importing @wizloft/harness-validation or its sibling packages (@wizloft/harness-evidence, @wizloft/harness-kernel) at affected versions.
- Ecosystems
- Attack vectors
- Affected entities
- @wizloft/harness-validationContains obfuscated malicious payload in dist/index.js that executes on import
- @wizloft/harness-evidenceSibling package with same trojanized-library pattern
- @wizloft/harness-kernelSibling package with same trojanized-library pattern
The npm package @wizloft/harness-validation contains heavily obfuscated malicious code appended to the legitimate TypeScript-compiled validation code in dist/index.js. The obfuscation uses obfuscator.io-style techniques including a 303-element string array and decoder function that executes at the top level when the package is imported.
The decoded payload queries Ethereum block explorers (h.drpc.org, pc.io/eth, stapi.io) for transactions from a hardcoded attacker wallet address (0xa322E5f3...). It extracts a URL or payload from the transaction data and fetches the resolved content, implementing a blockchain-based dead-drop mechanism. This allows the attacker to rotate the delivered malicious code by posting new transactions from their wallet, maintaining persistent remote-code execution against all processes that import the library.
Sibling packages @wizloft/harness-evidence and @wizloft/harness-kernel are declared as dependencies at matching alpha versions and exhibit the same trojanized-library pattern, suggesting a coordinated supply chain compromise across the @wizloft namespace.
Indicators of compromise
- Packages
- @wizloft/harness-validation
- @wizloft/harness-evidence
- @wizloft/harness-kernel
- Domains
- h.drpc.org
- pc.io
- stapi.io
Remediation
- Remove @wizloft/harness-validation, @wizloft/harness-evidence, and @wizloft/harness-kernel from all dependencies immediately
- Audit npm package.json and lock files for any use of @wizloft/* packages
- Review process execution logs and network traffic for connections to h.drpc.org, pc.io, or stapi.io during the period these packages were installed
- Rotate any credentials or secrets that may have been exposed to processes running with these packages
- Consider the affected Ethereum wallet address (0xa322E5f3...) as an indicator of compromise for blockchain transaction analysis
- Update to patched versions once available, or use alternative validation libraries
Sources
- GitHub Advisory GHSA-j9qg-xcv6-9cp8 · GitHub Advisory Database
Cite this entry
"Malicious code in @wizloft/harness-validation (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-wizloft-harness-validation-npm-1tf087
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit