MalwarePublished 5 Aug 2026Updated 19 Aug 2026

crypto-javas (npm) · Malicious Code

Affects crypto-javasSource GCVE Database

Malicious package : remove crypto-javas and rotate any secrets on hosts that installed it.

Data as of 19 Aug 2026, 16:23 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12359

What to do

Remove crypto-javas from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcrypto-javas	Affected =2.0.4 =2.0.7 =2.0.8	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'crypto-javas' contains malicious code that harvests environment variables and CI metadata, then exfiltrates this data to an attacker-controlled backend. This behavior occurs both during the postinstall hook and every time the package is imported or required. The package masquerades as '@wizlabs/js-crypto' but is a typosquat with a placeholder repository and generic author information. This leads to exposure of sensitive CI secrets such as AWS credentials, GitHub tokens, and other pipeline secrets. The affected versions are 2.0.4, 2.0.7, and 2.0.8. No official patch or remediation is currently documented.

Impact

Exposure of sensitive environment variables and CI/CD pipeline secrets to an attacker-controlled backend can lead to unauthorized access to cloud resources, source code repositories, and package registries. This compromises the confidentiality and integrity of the development and deployment environment, potentially enabling further attacks or data breaches.

Defensive guidance

Users should immediately remove 'crypto-javas' versions 2.0.4, 2.0.7, and 2.0.8 from their projects and replace them with trusted alternatives. Audit CI/CD pipelines and environment variables for potential exposure. Avoid using packages with suspicious repository URLs, generic author information, or typosquat names. Monitor for any unauthorized access using leaked credentials and rotate secrets if compromise is suspected.

Summary

The 'crypto-javas' npm package includes a postinstall script that executes setup.js, which collects nearly all environment variables except a small OS blocklist, along with CI job metadata like CI_JOB_ID, GITHUB_RUN_ID, project, commit, branch, and hostname. This data is sent via HTTPS POST to a backend URL and API key configurable through environment variables or configuration files. Additionally, the main entrypoint index.js calls autoExecute() at the module top level, causing the environment variable harvesting and exfiltration to occur on every import or require of the package. The package is presented misleadingly as '@wizlabs/js-crypto' but is a typosquat with a placeholder repository and a generic author handle, indicating malicious intent. This results in the leakage of sensitive CI/CD secrets including AWS credentials, GitHub tokens, NPM tokens, and CI job tokens to an attacker-controlled server.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 19 Aug 2026, 16:23 UTC

Technical details

References

Community reviews