@velora-dex/sdk Compromised on npm: Malicious Version Drops macOS Backdoor via launchctl Persistence
A malicious version of the @velora-dex/sdk npm package was published, delivering an architecture-aware macOS backdoor that activates on import with no visible indicators. The attack occurred at the registry level without repository commits or install hooks.
- Disclosed
- Last updated
- Blast radius
- Unknown scope; affects any developer or CI/CD environment that imported the malicious package version on macOS
- Ecosystems
- Attack vectors
- Affected entities
- @velora-dex/sdk
The npm package @velora-dex/sdk was compromised and a malicious version was published to the registry. The compromised release contains an architecture-aware macOS backdoor that executes when the package is imported into a project.
The backdoor establishes persistence using launchctl, a macOS system utility, without triggering any visible install hooks or requiring changes to the public repository. The malicious code fires immediately upon package import with no visible output, making detection difficult.
This is a registry-only supply chain attack, meaning the compromise occurred at the package registry level rather than through repository access or maintainer account takeover. Any macOS developer or CI/CD system that installed and imported the malicious version of @velora-dex/sdk would be affected.
Developers should immediately audit their environments for this package and remove any affected versions.
Indicators of compromise
- Packages
- @velora-dex/sdk
Remediation
- Immediately remove or downgrade @velora-dex/sdk to a known-safe version prior to the compromise
- Audit all macOS machines and CI/CD environments that may have imported the malicious package for signs of launchctl-based persistence mechanisms
- Check LaunchAgent and LaunchDaemon directories (/Library/LaunchDaemons, /Library/LaunchAgents, ~/Library/LaunchAgents) for suspicious entries
- Review process execution logs and network traffic for signs of backdoor activity
- Consider using security scanning tools to detect the specific backdoor artifacts if the package version is identified
- Monitor npm security advisories for official guidance and a list of affected versions
Sources
Cite this entry
"@velora-dex/sdk Compromised on npm: Malicious Version Drops macOS Backdoor via launchctl Persistence." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed April 9, 2026; last updated June 7, 2026. https://supplychainattack.org/incident/velora-dex-sdk-compromised-on-npm-malicious-version-drops-macos-backdoor-via-lau-10jrzk
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in eth-codergen
Malware was discovered in the npm package eth-codergen. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in fs-extra-core
Malware was discovered in the npm package fs-extra-core. Systems with this package installed or running are considered fully compromised and require immediate remediation including secret rotation and package removal.
npmCompromised package - containedcritical
Malware in cktool-core
Malware was discovered in the npm package cktool-core. Systems with the package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in lychee-norm-cache
Malware discovered in the npm package lychee-norm-cache. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package