Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in @zzzgenesis00/spl-token-utils (npm)

The npm package @zzzgenesis00/spl-token-utils contained malicious code in postinstall.js that harvested developer credentials and secrets during installation, exfiltrating them via Telegram Bot API and a remote server.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or CI/CD system that installed @zzzgenesis00/spl-token-utils during the malicious period; credential exposure affects downstream systems and services.
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • @zzzgenesis00/spl-token-utilsnpm package containing malicious postinstall.js

The npm package @zzzgenesis00/spl-token-utils was published with malicious code embedded in postinstall.js. The script executed unconditionally upon npm install, harvesting sensitive data from the installer's environment without consent.\n\nThe malicious script collected host identifiers, SSH keys (~/.ssh), npm credentials (~/.npmrc), git configuration (~/.gitconfig), browser profile data (Chrome/Firefox cookies, logins, key4.db), crypto wallet directory presence, and output from npm whoami and git config. It also targeted credential-shaped environment variables including NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS_*, *_PRIVATE_KEY, MNEMONIC, SEED_PHRASE, and API_KEY.\n\nCollected data was exfiltrated via two channels: the Telegram Bot API (bot ID 7231970337, chat 7231970337) and a POST request to https://40f955f39128bd79-178-249-214-24.serveousercontent.com/collect. Execution was delayed 1.5–3.5 seconds via randomized setTimeout, and identifiers were obfuscated with random 3-letter prefixes to evade detection. The package included a cover-story comment claiming "environment verification" and a passthrough export to appear as a legitimate Solana SPL token utility.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • @zzzgenesis00/spl-token-utils
Domains
  • api.telegram.org
  • 40f955f39128bd79-178-249-214-24.serveousercontent.com

Remediation

  • Immediately uninstall @zzzgenesis00/spl-token-utils from all systems and CI/CD pipelines
  • Rotate all credentials and secrets that may have been exposed (NPM tokens, GitHub tokens, AWS credentials, SSH keys, API keys, mnemonics, seed phrases)
  • Review npm install logs and git history to identify when the package was installed
  • Audit browser profiles and crypto wallets for unauthorized access
  • Monitor Telegram bot and exfiltration server for evidence of data transmission
  • Use npm audit to identify any other malicious packages in your dependency tree
  • Implement package verification and integrity checks in your supply chain

Sources

  1. GitHub Advisory GHSA-6fpm-pvw8-qj34 · GitHub Advisory Database

Cite this entry

"Malicious code in @zzzgenesis00/spl-token-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-zzzgenesis00-spl-token-utils-npm-1ffwk3

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in 3-buildsight-web (npm)

    The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.

    npmCompromised package
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in create-coin (npm)

    create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.

    npmCompromised packageTyposquatting
  4. resolvedcritical

    Malicious code in @syncraft-labs/vue (npm)

    The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.

    npmCompromised package