Malicious code in @emcd-vue/auth (npm)
The @emcd-vue/auth npm package is a malicious supply-chain attack component impersonating a legitimate Russian cryptocurrency exchange's internal tooling. It contains no legitimate code but a heavily obfuscated postinstall script that downloads and executes a platform-specific payload, exfiltrates host metadata, and persists beyond npm installation. The package targets versions 6.4.5, 6.4.8, 6.4.9, and 7.0.0. Systems with this package installed should be considered fully compromised, and all secrets should be rotated from a clean environment.
AI Analysis
Technical Summary
This threat involves a malicious npm package, @emcd-vue/auth, used in a coordinated multi-package supply-chain attack impersonating EMCD, a Russian cryptocurrency exchange. The package is a hollow shell with no functional library code, containing a single obfuscated postinstall hook that executes on npm install. The postinstall script checks for a kill-switch environment variable, deduplicates execution per host/project, detects the platform, and downloads a platform-specific second-stage payload from an attacker-controlled server using a secret header. The payload is saved as a hidden file in the user's home directory and executed as a detached process that persists after npm exits. Installation metadata and host-identifying information are exfiltrated to the attacker. The spawned payload inherits the full environment variables, potentially exposing credentials. The affected versions are exactly 6.4.5, 6.4.8, 6.4.9, and 7.0.0. Removal of the package does not guarantee full remediation due to potential persistence and full system compromise.
Potential Impact
Any system with this package installed is considered fully compromised. The attacker gains persistent remote code execution via a multi-stage payload, exfiltrates host metadata and environment variables (including credentials), and can maintain control beyond the npm installation process. This can lead to unauthorized access, data theft, and further malicious activity on the affected system.
Mitigation Recommendations
No official patch or fix is available for this malicious package. Immediate removal of the @emcd-vue/auth package versions 6.4.5, 6.4.8, 6.4.9, and 7.0.0 is required. Because the package grants full system compromise, all secrets and credentials on the affected system should be considered compromised and rotated from a clean, trusted environment. Full system reimaging or forensic analysis is recommended to ensure complete removal of any persistent malicious components. Monitor for any signs of compromise related to this package and avoid installing packages from untrusted or suspicious npm scopes.
Malicious code in @emcd-vue/auth (npm)
Description
The @emcd-vue/auth npm package is a malicious supply-chain attack component impersonating a legitimate Russian cryptocurrency exchange's internal tooling. It contains no legitimate code but a heavily obfuscated postinstall script that downloads and executes a platform-specific payload, exfiltrates host metadata, and persists beyond npm installation. The package targets versions 6.4.5, 6.4.8, 6.4.9, and 7.0.0. Systems with this package installed should be considered fully compromised, and all secrets should be rotated from a clean environment.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This threat involves a malicious npm package, @emcd-vue/auth, used in a coordinated multi-package supply-chain attack impersonating EMCD, a Russian cryptocurrency exchange. The package is a hollow shell with no functional library code, containing a single obfuscated postinstall hook that executes on npm install. The postinstall script checks for a kill-switch environment variable, deduplicates execution per host/project, detects the platform, and downloads a platform-specific second-stage payload from an attacker-controlled server using a secret header. The payload is saved as a hidden file in the user's home directory and executed as a detached process that persists after npm exits. Installation metadata and host-identifying information are exfiltrated to the attacker. The spawned payload inherits the full environment variables, potentially exposing credentials. The affected versions are exactly 6.4.5, 6.4.8, 6.4.9, and 7.0.0. Removal of the package does not guarantee full remediation due to potential persistence and full system compromise.
Potential Impact
Any system with this package installed is considered fully compromised. The attacker gains persistent remote code execution via a multi-stage payload, exfiltrates host metadata and environment variables (including credentials), and can maintain control beyond the npm installation process. This can lead to unauthorized access, data theft, and further malicious activity on the affected system.
Mitigation Recommendations
No official patch or fix is available for this malicious package. Immediate removal of the @emcd-vue/auth package versions 6.4.5, 6.4.8, 6.4.9, and 7.0.0 is required. Because the package grants full system compromise, all secrets and credentials on the affected system should be considered compromised and rotated from a clean, trusted environment. Full system reimaging or forensic analysis is recommended to ensure complete removal of any persistent malicious components. Monitor for any signs of compromise related to this package and avoid installing packages from untrusted or suspicious npm scopes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5163
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-gj65-7753-2q9f"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a55ff5968715ace432f0975
Added to database: 07/14/2026, 09:20:25 UTC
Last enriched: 07/14/2026, 09:28:49 UTC
Last updated: 07/28/2026, 05:43:04 UTC
Views: 106
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.