Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in @zzzgenesis00/spl-token-utils (npm)

The npm package @zzzgenesis00/spl-token-utils contained malicious code in postinstall.js that harvested developer credentials and secrets during installation, exfiltrating them via Telegram Bot API and a remote server.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or CI/CD system that installed @zzzgenesis00/spl-token-utils during the malicious period; credential exposure affects downstream systems and services.
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • @zzzgenesis00/spl-token-utilsnpm package containing malicious postinstall.js

The npm package @zzzgenesis00/spl-token-utils was published with malicious code embedded in postinstall.js. The script executed unconditionally upon npm install, harvesting sensitive data from the installer's environment without consent.\n\nThe malicious script collected host identifiers, SSH keys (~/.ssh), npm credentials (~/.npmrc), git configuration (~/.gitconfig), browser profile data (Chrome/Firefox cookies, logins, key4.db), crypto wallet directory presence, and output from npm whoami and git config. It also targeted credential-shaped environment variables including NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS_*, *_PRIVATE_KEY, MNEMONIC, SEED_PHRASE, and API_KEY.\n\nCollected data was exfiltrated via two channels: the Telegram Bot API (bot ID 7231970337, chat 7231970337) and a POST request to https://40f955f39128bd79-178-249-214-24.serveousercontent.com/collect. Execution was delayed 1.5–3.5 seconds via randomized setTimeout, and identifiers were obfuscated with random 3-letter prefixes to evade detection. The package included a cover-story comment claiming "environment verification" and a passthrough export to appear as a legitimate Solana SPL token utility.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • @zzzgenesis00/spl-token-utils
Domains
  • api.telegram.org
  • 40f955f39128bd79-178-249-214-24.serveousercontent.com

Remediation

  • Immediately uninstall @zzzgenesis00/spl-token-utils from all systems and CI/CD pipelines
  • Rotate all credentials and secrets that may have been exposed (NPM tokens, GitHub tokens, AWS credentials, SSH keys, API keys, mnemonics, seed phrases)
  • Review npm install logs and git history to identify when the package was installed
  • Audit browser profiles and crypto wallets for unauthorized access
  • Monitor Telegram bot and exfiltration server for evidence of data transmission
  • Use npm audit to identify any other malicious packages in your dependency tree
  • Implement package verification and integrity checks in your supply chain

Sources

  1. GitHub Advisory GHSA-6fpm-pvw8-qj34 · GitHub Advisory Database

Cite this entry

"Malicious code in @zzzgenesis00/spl-token-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-zzzgenesis00-spl-token-utils-npm-1ffwk3

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in santana-baileys (npm)

    Malicious code discovered in santana-baileys npm package that covertly relays WhatsApp messaging data to an attacker-controlled endpoint (https://fiora.nixel.my.id/) via obfuscated character-code reconstruction in the message-send code path.

    npmCompromised package
  2. resolvedcritical

    Malicious code in elephant-tusk-runner (npm)

    The npm package elephant-tusk-runner contained malicious code that exposed a remote shell and remote code execution surface via an unauthenticated Express + WebSocket server binding to 0.0.0.0:4201 with fully open CORS. Any peer able to reach the port could execute arbitrary commands on the host.

    npmCompromised package
  3. resolvedcritical

    Malicious code in @cats-cdf/browser-metrics-meter (npm)

    The npm package @cats-cdf/browser-metrics-meter contained malicious code in its preinstall lifecycle script that exfiltrated system reconnaissance data (username, hostname, public IP) to an OAST collector domain. The package executed this behavior unconditionally on installation without consent or documented purpose.

    npmCompromised package
  4. resolvedcritical

    Malicious code in @ks-video/kwai-player-web (npm)

    The npm package @ks-video/kwai-player-web contained malicious code in its postinstall hook that exfiltrated system reconnaissance data (hostname, username, working directory, network interfaces, environment variable names) over plain HTTP to an unrelated third-party domain. The package has no legitimate relationship to the declared publisher Kwai/@ks-video.

    npmCompromised package