Malicious code in @zzzgenesis00/playwrite (npm)
@zzzgenesis00/playwrite is a typosquat of the legitimate playwright package that executes malicious code on npm install. The package harvests credentials, SSH keys, browser cookies, and system information, exfiltrating them to a hardcoded remote server.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed @zzzgenesis00/playwrite from npm
- Ecosystems
- Attack vectors
- Affected entities
- @zzzgenesis00/playwrite
@zzzgenesis00/playwrite is a typosquatting attack targeting developers who may mistype the legitimate playwright package name. The malicious package exports stub methods for the launch() function while concealing its true purpose.
Upon installation, the package's postinstall.js script executes automatically, collecting sensitive system and credential information including hostname, username, home directory, platform, Node version, npm registry configuration, and the output of npm whoami. It harvests credential-shaped environment variables such as NPM_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, DOCKER_PASSWORD, GCLOUD_ACCESS_TOKEN, and NPM_CONFIG.
The malicious code also enumerates SSH keys (~/.ssh directory for id_rsa, id_ed25519, id_ecdsa and their .pub files), reads ~/.npmrc and ~/.gitconfig, and scans browser profile directories (Chrome, Chromium, Firefox) for cookies and login data. All collected data is JSON-POSTed over HTTPS to a hardcoded Serveo reverse-tunnel host (40f955f39128bd79-178-249-214-24.serveousercontent.com) at the /collect path, with error handling designed to keep npm install silent on failure.
This incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- @zzzgenesis00/playwrite
- Domains
- 40f955f39128bd79-178-249-214-24.serveousercontent.com
Remediation
- Immediately uninstall @zzzgenesis00/playwrite from all systems and projects
- Rotate all credentials that may have been exposed (NPM tokens, GitHub tokens, AWS keys, Docker passwords, GCP tokens)
- Review SSH keys and consider regenerating them if they were present in ~/.ssh
- Audit npm registry configuration and .npmrc files for unauthorized changes
- Check browser cookie and login data for unauthorized access
- Review git configuration and any commits made during the exposure window
- Use the legitimate playwright package instead
- Implement package name verification and typosquat detection in dependency management workflows
Sources
- GitHub Advisory GHSA-c5v7-846x-pcgr · GitHub Advisory Database
Cite this entry
"Malicious code in @zzzgenesis00/playwrite (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-zzzgenesis00-playwrite-npm-namz22
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in alelo-payment (npm)
The npm package alelo-payment (version 99.0.0) contained malicious code that exfiltrated sensitive environment variables, credentials, and system information during installation. The package appears to be a typosquat or dependency-confusion attack targeting an internal Alelo utility.
npmCompromised packageTyposquatting