MAL-2026-6794: Malicious code in zod-pino434 (npm)
The npm package 'zod-pino434' (versions 1.0.127 and 1.0.128) is a malicious package masquerading as a Node.js integration layer for Autodesk Forge. Upon installation, it executes a postinstall script that runs a hidden background agent connecting to a remote command-and-control relay. This agent establishes persistence on the host by registering itself for OS autostart and performs extensive data theft, including scanning for cryptocurrency wallet keys and mnemonics, harvesting browser extension databases (notably targeting wallet extensions like MetaMask and Phantom), and exfiltrating this data to external servers. It also collects host inventory information and screenshots, sending these to attacker-controlled endpoints. The package includes embedded encrypted credentials and uses encrypted communication channels to evade detection.
AI Analysis
Technical Summary
The 'zod-pino434' npm package versions 1.0.127 and 1.0.128 contain malicious code that executes during installation. The postinstall script runs a background agent that connects via encrypted WebSocket to a remote relay. The agent installs persistent autostart mechanisms on Windows, macOS, and Linux. It scans the system for cryptocurrency wallet secrets (BIP39 mnemonics, secp256k1/WIF private keys, BIP32 extended keys) and forcibly accesses locked browser extension databases across multiple Chromium-based browsers, including those storing wallet data. Harvested data is exfiltrated to the Hugging Face Hub and relayed via Discord channels using embedded encrypted credentials. Additional surveillance includes host inventory reporting and screenshot capture. The implant survives package removal due to durable autostart installation.
Potential Impact
This malicious package enables remote code execution at install time, persistent presence on the host, and extensive credential theft targeting cryptocurrency wallets and browser extension data. It compromises user privacy and security by exfiltrating sensitive cryptographic keys and wallet information, potentially leading to theft of digital assets. The implant also collects host system information and screenshots, facilitating further attacker reconnaissance and control. The use of encrypted communication and embedded credentials complicates detection and mitigation.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package. Users and organizations should immediately remove the 'zod-pino434' package versions 1.0.127 and 1.0.128 from their environments. Avoid installing or using this package. Conduct thorough host inspections for persistence mechanisms under OS autostart locations and remove any related files or processes. Investigate for signs of credential theft or exfiltration, especially related to cryptocurrency wallets and browser extensions. Monitor for suspicious network connections to unknown WebSocket relays or external services such as the Hugging Face Hub or Discord channels. Consider resetting or migrating any potentially compromised cryptocurrency wallets. Patch status is not yet confirmed — check the vendor advisory or trusted threat intelligence sources for updates.
MAL-2026-6794: Malicious code in zod-pino434 (npm)
Description
The npm package 'zod-pino434' (versions 1.0.127 and 1.0.128) is a malicious package masquerading as a Node.js integration layer for Autodesk Forge. Upon installation, it executes a postinstall script that runs a hidden background agent connecting to a remote command-and-control relay. This agent establishes persistence on the host by registering itself for OS autostart and performs extensive data theft, including scanning for cryptocurrency wallet keys and mnemonics, harvesting browser extension databases (notably targeting wallet extensions like MetaMask and Phantom), and exfiltrating this data to external servers. It also collects host inventory information and screenshots, sending these to attacker-controlled endpoints. The package includes embedded encrypted credentials and uses encrypted communication channels to evade detection.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'zod-pino434' npm package versions 1.0.127 and 1.0.128 contain malicious code that executes during installation. The postinstall script runs a background agent that connects via encrypted WebSocket to a remote relay. The agent installs persistent autostart mechanisms on Windows, macOS, and Linux. It scans the system for cryptocurrency wallet secrets (BIP39 mnemonics, secp256k1/WIF private keys, BIP32 extended keys) and forcibly accesses locked browser extension databases across multiple Chromium-based browsers, including those storing wallet data. Harvested data is exfiltrated to the Hugging Face Hub and relayed via Discord channels using embedded encrypted credentials. Additional surveillance includes host inventory reporting and screenshot capture. The implant survives package removal due to durable autostart installation.
Potential Impact
This malicious package enables remote code execution at install time, persistent presence on the host, and extensive credential theft targeting cryptocurrency wallets and browser extension data. It compromises user privacy and security by exfiltrating sensitive cryptographic keys and wallet information, potentially leading to theft of digital assets. The implant also collects host system information and screenshots, facilitating further attacker reconnaissance and control. The use of encrypted communication and embedded credentials complicates detection and mitigation.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package. Users and organizations should immediately remove the 'zod-pino434' package versions 1.0.127 and 1.0.128 from their environments. Avoid installing or using this package. Conduct thorough host inspections for persistence mechanisms under OS autostart locations and remove any related files or processes. Investigate for signs of credential theft or exfiltration, especially related to cryptocurrency wallets and browser extensions. Monitor for suspicious network connections to unknown WebSocket relays or external services such as the Hugging Face Hub or Discord channels. Consider resetting or migrating any potentially compromised cryptocurrency wallets. Patch status is not yet confirmed — check the vendor advisory or trusted threat intelligence sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6794
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4c348927e9c79719607918
Added to database: 07/06/2026, 23:04:41 UTC
Last enriched: 07/06/2026, 23:41:30 UTC
Last updated: 07/06/2026, 23:41:30 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.