Malicious code in api-changelly (npm)
The npm package 'api-changelly' is a malicious package impersonating the Changelly crypto-exchange brand. It contains no legitimate functionality and executes code during installation that collects system and user information, then sends this data to a hardcoded external server. This behavior is typical of dependency confusion attacks targeting internal build systems that mistakenly resolve private dependencies to this malicious public package.
AI Analysis
Technical Summary
The 'api-changelly' npm package declares a preinstall script that runs automatically on 'npm install'. This script collects various installer identifiers such as hostname, platform, architecture, user information, and executes system commands 'whoami' and 'id' to gather user and system details. The collected data is combined into a JSON payload and sent via HTTP POST to a hardcoded Burp Collaborator subdomain. The package impersonates the Changelly brand but provides no legitimate functionality, serving solely as a reconnaissance beacon in dependency confusion scenarios.
Potential Impact
Installation of this package results in unauthorized disclosure of sensitive system and user information to an external attacker-controlled server. This can lead to reconnaissance on internal build environments, potentially facilitating further targeted attacks or exploitation of internal infrastructure.
Mitigation Recommendations
No official patch or remediation is indicated. Users should avoid installing the 'api-changelly' package, especially in internal build systems. Verify and lock down dependency sources to prevent dependency confusion attacks by ensuring private dependencies are resolved correctly and not overridden by malicious public packages.
Malicious code in api-changelly (npm)
Description
The npm package 'api-changelly' is a malicious package impersonating the Changelly crypto-exchange brand. It contains no legitimate functionality and executes code during installation that collects system and user information, then sends this data to a hardcoded external server. This behavior is typical of dependency confusion attacks targeting internal build systems that mistakenly resolve private dependencies to this malicious public package.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'api-changelly' npm package declares a preinstall script that runs automatically on 'npm install'. This script collects various installer identifiers such as hostname, platform, architecture, user information, and executes system commands 'whoami' and 'id' to gather user and system details. The collected data is combined into a JSON payload and sent via HTTP POST to a hardcoded Burp Collaborator subdomain. The package impersonates the Changelly brand but provides no legitimate functionality, serving solely as a reconnaissance beacon in dependency confusion scenarios.
Potential Impact
Installation of this package results in unauthorized disclosure of sensitive system and user information to an external attacker-controlled server. This can lead to reconnaissance on internal build environments, potentially facilitating further targeted attacks or exploitation of internal infrastructure.
Mitigation Recommendations
No official patch or remediation is indicated. Users should avoid installing the 'api-changelly' package, especially in internal build systems. Verify and lock down dependency sources to prevent dependency confusion attacks by ensuring private dependencies are resolved correctly and not overridden by malicious public packages.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10200
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a54ae1068715ace438f8d03
Added to database: 07/13/2026, 09:21:20 UTC
Last enriched: 09/12/2026, 16:48:05 UTC
Last updated: 09/12/2026, 16:48:05 UTC
Views: 84
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.