Malicious code in zeal-rq-hooks (npm)
The npm package zeal-rq-hooks contained malicious code in canary.js that collected host-identifying reconnaissance data (hostname, username, platform, working directory) and transmitted it to an external endpoint (https://npm-canary.aveliscare.com) without user configuration or consent.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed zeal-rq-hooks
- Ecosystems
- Attack vectors
- Affected entities
- zeal-rq-hooksnpm package containing malicious canary.js code
The npm package zeal-rq-hooks was found to contain malicious code embedded in a file named canary.js. The malicious code imports Node.js built-in modules (os, http, https) and performs unauthorized reconnaissance.
At line 123 of canary.js, the code POSTs a JSON payload to a hardcoded external endpoint (https://npm-canary.aveliscare.com). The payload contains sensitive host-identifying information including os.hostname(), os.userInfo(), process.platform, Node.js and npm version information, and the current working directory (cwd).
The endpoint hostname is not associated with the npm registry or any documented publisher, and the network destination is hardcoded directly in the package code with no user-configurable option to disable or redirect the transmission. This represents a clear supply chain compromise delivering reconnaissance malware to all users who installed the affected package.
The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- zeal-rq-hooks
- Domains
- npm-canary.aveliscare.com
Remediation
- Immediately uninstall zeal-rq-hooks from all systems
- Audit npm package.json and lock files for presence of zeal-rq-hooks
- Review system logs and network traffic for connections to https://npm-canary.aveliscare.com during the period the package was installed
- Regenerate any credentials or sensitive data that may have been exposed while the package was active
- Update npm dependencies to remove zeal-rq-hooks and verify no replacement package has similar malicious behavior
- Consider implementing npm package scanning and verification tools to detect similar threats in the future
Sources
- GitHub Advisory GHSA-62m8-8rfw-gv5v · GitHub Advisory Database
Cite this entry
"Malicious code in zeal-rq-hooks (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 11, 2026. https://supplychainattack.org/incident/malicious-code-in-zeal-rq-hooks-npm-f020dv
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - containedcritical
Malicious code in epic-common (npm)
The npm package epic-common was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - containedcritical
Malware in leb128x
The npm package leb128x was found to contain malware that grants full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - containedcritical
Malicious code in checkout-desktop-total (npm)
The npm package checkout-desktop-total contained malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under wel1.ru. Any system that imported this package should be considered compromised.
npmCompromised package