Malicious code in @zzzgenesis00/docker-api-client (npm)
@zzzgenesis00/docker-api-client, a malicious npm package impersonating the legitimate docker-api-client, contained a postinstall script that harvested developer secrets and credentials and exfiltrated them via Telegram and a reverse-tunnel host.
- Disclosed
- Last updated
- Blast radius
- Any developer who installed @zzzgenesis00/docker-api-client via npm; secrets and credentials exposed at install time.
- Ecosystems
- Attack vectors
- Affected entities
- @zzzgenesis00/docker-api-clientMalicious npm package impersonating legitimate docker-api-client
@zzzgenesis00/docker-api-client is a malicious npm package that impersonates the legitimate docker-api-client maintained by apocas. The package.json falsely declares the author as apocas and references the legitimate repository, but the scoped name @zzzgenesis00/docker-api-client is unrelated to the actual maintainer.
The malicious postinstall.js script executes automatically upon npm install and enumerates sensitive locations including ~/.ssh, ~/.npmrc, ~/.gitconfig, Chrome and Firefox profile directories, and cryptocurrency wallet directories. It also collects hardcoded secret environment variables including NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS keys, MNEMONIC, SEED_PHRASE, ETHEREUM_PRIVATE_KEY, and other API keys.
The harvested credentials are exfiltrated via two channels: HTTPS GET requests to api.telegram.org using a hardcoded bot token and chat_id, and HTTPS POST requests to /collect on 40f955f39128bd79-178-249-214-24.serveousercontent.com (a serveo reverse-tunnel host). The exfiltration includes a randomized 1.5-3.5 second delay to evade detection.
The incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- @zzzgenesis00/docker-api-client
- Domains
- api.telegram.org
- 40f955f39128bd79-178-249-214-24.serveousercontent.com
Remediation
- Immediately uninstall @zzzgenesis00/docker-api-client from all systems
- Rotate all secrets and credentials that may have been exposed (NPM_TOKEN, GITHUB_TOKEN, AWS keys, SSH keys, etc.)
- Review ~/.ssh, ~/.npmrc, ~/.gitconfig, and browser profile directories for unauthorized access
- Check cryptocurrency wallet activity for unauthorized transactions
- Audit environment variables and API keys for unauthorized use
- Use the legitimate docker-api-client package (apocas/docker-api-client) if Docker API client functionality is needed
- Review npm audit logs and package installation history for other suspicious packages
Sources
- GitHub Advisory GHSA-p492-926f-h775 · GitHub Advisory Database
Cite this entry
"Malicious code in @zzzgenesis00/docker-api-client (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-zzzgenesis00-docker-api-client-npm-1iunkl
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - containedcritical
Malicious code in axios-fast (npm)
axios-fast@1.0.1 on npm contains malicious code that exfiltrates environment variables (including AWS credentials, NPM tokens, and GitHub tokens) to an attacker-controlled webhook during package installation. The package typosquats the legitimate axios HTTP client library.
npmCompromised packageTyposquatting