Malicious code in @emcd-vue/b2b-pay-form (npm)
Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency exchange and mining pool. The attacker registered the `@emcd-vue` npm scope to distribute multiple malicious packages posing as internal tooling under the "EMCD Platform Engineering" identity. This package was published on the same day as confirmed campaign packages `@emcd-vue/auth` and `@emcd-vue/loans`, which share C2 infrastructure at `oob.moika.tech`. The package description ("Internal HTTP client with retry, auth injection and request tracing") is fabricated; the `@emcd-vue` scope has no affiliation with the real EMCD exchange (`emcd.io`). Campaign packages in this scope use a multi-stage postinstall dropper that downloads and executes a platform-specific payload from `https://oob.moika.tech/payload/{platform}` using a shared secret key, writes the payload to a hidden dot-file in the user's home directory, and beacons installation metadata to `https://oob.moika.tech/report`. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e45e677cee670117b0ff7dcdf2f04491cfb61385025a178e197ea35924e9410e) @emcd-vue/b2b-pay-form ships an obfuscator.io-encoded scripts/postinstall.js wired as the npm `postinstall` lifecycle hook. On `npm install`, the script builds a platform-keyed URL from `os.platform()`, performs an HTTPS GET of a remote payload, writes it to `os.tmpdir()`, and spawns it via `spawn(process.execPath, [tmpFile], {detached:true}).unref()` — a classic install-time dropper that grants the publisher arbitrary remote code execution on every installing host. An environment-variable kill switch and a TTL-gated JSON cache in the user home directory throttle re-execution to evade detection. The package's stated purpose is an 'Internal HTTP client'; fetching and executing remote Node code is unrelated to that purpose. The package metadata is also fabricated dependency-confusion bait: scope `@emcd-vue` and all referenced domains (`emcd-vue.io`, `github.emcd-vue.io`, `jira.emcd-vue.io`, `docs.emcd-vue.io`, `npm.emcd-vue.io`, `telemetry.emcd-vue.io`) are not owned by any public organization, and the README instructs consumers to point npm at `https://npm.emcd-vue.io` while branding the package as 'Internal package — Platform Engineering Team' — the canonical pattern for targeting orgs whose private internal scope matches `@emcd-vue` or whose CI lazily resolves unknown scopes from the public registry. The postinstall file itself is heavily obfuscated (string-array + RC4-style decoder, control-flow flattening, self-defending function, 109-entry encoded string table), which has no legitimate purpose for a lifecycle script and is consistent with evasion of review. ## Source: ghsa-malware (d90cd206861b8a82dbbf2519456e475cb2aae36d33267bfb0b6a512cf51366e4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The @emcd-vue/b2b-pay-form npm package is a malicious supply-chain threat masquerading as an internal HTTP client. Upon installation, its obfuscated postinstall script constructs a platform-specific URL and downloads a remote payload from a command-and-control server (oob.moika.tech). This payload is written to a temporary directory and executed detached from the install process, granting the attacker arbitrary remote code execution on the installing system. The package scope and metadata are fabricated to impersonate the EMCD cryptocurrency exchange's internal tooling, serving as bait for organizations with matching private scopes. The postinstall script uses obfuscation techniques and caching mechanisms to evade detection and limit repeated execution. This package is part of a broader campaign involving multiple malicious packages sharing infrastructure and tactics.
Potential Impact
Installation of any affected version of this package results in arbitrary remote code execution on the host system during the npm install process. This allows attackers to execute malicious payloads with the privileges of the installing user, potentially leading to system compromise, data theft, or further lateral movement. The obfuscation and evasion techniques complicate detection and analysis. The fabricated package metadata increases the risk of inadvertent installation by organizations using private npm scopes similar to @emcd-vue.
Mitigation Recommendations
No official patch or fix is available as this is a malicious package published to the public npm registry. The best mitigation is to avoid installing any versions of @emcd-vue/b2b-pay-form listed as affected (=5.7.3, =5.7.4, =5.7.5, =5.8.0). Organizations should audit their dependencies for this package and remove it if found. Additionally, verify the authenticity of npm scopes and packages before installation, especially those claiming to be internal or private tooling. Use strict package allowlists and monitor for suspicious postinstall scripts. Since this is not a cloud service, remediation depends on removing the package and cleaning affected hosts.
Malicious code in @emcd-vue/b2b-pay-form (npm)
Description
Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency exchange and mining pool. The attacker registered the `@emcd-vue` npm scope to distribute multiple malicious packages posing as internal tooling under the "EMCD Platform Engineering" identity. This package was published on the same day as confirmed campaign packages `@emcd-vue/auth` and `@emcd-vue/loans`, which share C2 infrastructure at `oob.moika.tech`. The package description ("Internal HTTP client with retry, auth injection and request tracing") is fabricated; the `@emcd-vue` scope has no affiliation with the real EMCD exchange (`emcd.io`). Campaign packages in this scope use a multi-stage postinstall dropper that downloads and executes a platform-specific payload from `https://oob.moika.tech/payload/{platform}` using a shared secret key, writes the payload to a hidden dot-file in the user's home directory, and beacons installation metadata to `https://oob.moika.tech/report`. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e45e677cee670117b0ff7dcdf2f04491cfb61385025a178e197ea35924e9410e) @emcd-vue/b2b-pay-form ships an obfuscator.io-encoded scripts/postinstall.js wired as the npm `postinstall` lifecycle hook. On `npm install`, the script builds a platform-keyed URL from `os.platform()`, performs an HTTPS GET of a remote payload, writes it to `os.tmpdir()`, and spawns it via `spawn(process.execPath, [tmpFile], {detached:true}).unref()` — a classic install-time dropper that grants the publisher arbitrary remote code execution on every installing host. An environment-variable kill switch and a TTL-gated JSON cache in the user home directory throttle re-execution to evade detection. The package's stated purpose is an 'Internal HTTP client'; fetching and executing remote Node code is unrelated to that purpose. The package metadata is also fabricated dependency-confusion bait: scope `@emcd-vue` and all referenced domains (`emcd-vue.io`, `github.emcd-vue.io`, `jira.emcd-vue.io`, `docs.emcd-vue.io`, `npm.emcd-vue.io`, `telemetry.emcd-vue.io`) are not owned by any public organization, and the README instructs consumers to point npm at `https://npm.emcd-vue.io` while branding the package as 'Internal package — Platform Engineering Team' — the canonical pattern for targeting orgs whose private internal scope matches `@emcd-vue` or whose CI lazily resolves unknown scopes from the public registry. The postinstall file itself is heavily obfuscated (string-array + RC4-style decoder, control-flow flattening, self-defending function, 109-entry encoded string table), which has no legitimate purpose for a lifecycle script and is consistent with evasion of review. ## Source: ghsa-malware (d90cd206861b8a82dbbf2519456e475cb2aae36d33267bfb0b6a512cf51366e4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @emcd-vue/b2b-pay-form npm package is a malicious supply-chain threat masquerading as an internal HTTP client. Upon installation, its obfuscated postinstall script constructs a platform-specific URL and downloads a remote payload from a command-and-control server (oob.moika.tech). This payload is written to a temporary directory and executed detached from the install process, granting the attacker arbitrary remote code execution on the installing system. The package scope and metadata are fabricated to impersonate the EMCD cryptocurrency exchange's internal tooling, serving as bait for organizations with matching private scopes. The postinstall script uses obfuscation techniques and caching mechanisms to evade detection and limit repeated execution. This package is part of a broader campaign involving multiple malicious packages sharing infrastructure and tactics.
Potential Impact
Installation of any affected version of this package results in arbitrary remote code execution on the host system during the npm install process. This allows attackers to execute malicious payloads with the privileges of the installing user, potentially leading to system compromise, data theft, or further lateral movement. The obfuscation and evasion techniques complicate detection and analysis. The fabricated package metadata increases the risk of inadvertent installation by organizations using private npm scopes similar to @emcd-vue.
Mitigation Recommendations
No official patch or fix is available as this is a malicious package published to the public npm registry. The best mitigation is to avoid installing any versions of @emcd-vue/b2b-pay-form listed as affected (=5.7.3, =5.7.4, =5.7.5, =5.8.0). Organizations should audit their dependencies for this package and remove it if found. Additionally, verify the authenticity of npm scopes and packages before installation, especially those claiming to be internal or private tooling. Use strict package allowlists and monitor for suspicious postinstall scripts. Since this is not a cloud service, remediation depends on removing the package and cleaning affected hosts.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5164
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50baa768715ace43584fea
Added to database: 07/10/2026, 09:25:59 UTC
Last enriched: 07/10/2026, 10:15:07 UTC
Last updated: 07/25/2026, 08:29:38 UTC
Views: 24
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.