Malicious code in forge-jsx2 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0ce40276c3c58337b7db3272f89e0716b017b4d63bfa625b8757b9d1969ec9f9) The package masquerades as an 'Autodesk Forge' integration but ships no Forge API code. On `npm install`, `scripts/postinstall-agent.mjs` materializes a durable copy of the package outside node_modules (under a hidden `.forge-jsxyz/runtime/` directory), spawns `dist/cli-agent.js` as a detached, unrefed background process, and registers OS autostart (launchd/systemd/Windows Run) so the agent survives `npm uninstall`. The agent's relay WebSocket destination is concealed via AES-256-GCM with a key reconstructed from XOR-obfuscated halves embedded in `dist/deploymentCipherData.js`; a leftover diagnostic script (`scripts/windows-forge-diagnostics.ps1`) reveals the hidden host as `212.193.3.61:9877`. Once connected, the agent (1) walks the entire filesystem (`/` on POSIX, every drive on Windows) via `dist/secretScan/agentStartupAudit.js` looking for BIP39 mnemonics, secp256k1 private keys, BIP32 xprv/zprv, and WIF keys, then uploads results including the secret material to an attacker-controlled HuggingFace repo at `agents/<hostname>/result.json`; (2) enumerates every local user profile and recursively copies Chromium-family `Local Extension Settings/<extension_id>/` and `IndexedDB/chrome-extension_*` LevelDB trees (where MetaMask and other wallet extensions store keys) via `dist/chromiumExtensionDbHarvest.js` and uploads them to HuggingFace via `dist/extensionDbHfUpload.js`; (3) periodically captures desktop screenshots (10–600s interval) and relays them to a Discord channel via `dist/discordRelayUpload.js` using `https://discord.com/api/v10`; (4) exposes a remote filesystem read/write explorer and keyboard/clipboard injection (`fsProtocol.js`, `filesExplorer.js`, `windowsInputSync`, `win32InputNative`) to the relay operator, gated only by a default password baked into the encrypted bundle. ## Source: ghsa-malware (cdda3bc454a770043918f1aa9dd3a90ab538733787b052229819c1eeca3488b9) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The forge-jsx2 npm package (versions 1.0.123, 1.0.124, 1.0.125) contains malicious code that installs a persistent background agent on the victim system. This agent hides itself outside the node_modules directory, registers for OS autostart, and connects via a concealed WebSocket to an attacker-controlled server at IP 212.193.3.61:9877. It performs extensive reconnaissance by scanning the entire filesystem for cryptocurrency wallet keys (BIP39 mnemonics, secp256k1 private keys, BIP32 xprv/zprv, WIF keys), harvesting browser extension databases related to wallets, capturing desktop screenshots at intervals, and exposing remote filesystem read/write and keyboard/clipboard injection capabilities protected only by a default password. The stolen data is exfiltrated to a HuggingFace repository and Discord channels. Due to the deep system compromise, removal of the package alone does not guarantee eradication of the malware or attacker persistence.
Potential Impact
Systems with the affected forge-jsx2 package installed are fully compromised. Sensitive cryptographic keys and wallet secrets can be stolen, enabling theft of cryptocurrency assets. Browser extension data related to wallets is also exfiltrated, increasing risk of account compromise. Persistent background processes and OS autostart registration allow the attacker to maintain long-term access. Remote control capabilities including filesystem manipulation and input injection enable further malicious actions. Overall, the confidentiality, integrity, and availability of the affected systems and their data are severely impacted.
Mitigation Recommendations
No official patch or fix is currently available. Immediate removal of the forge-jsx2 package is recommended; however, because the malware installs persistent background agents that survive uninstall, full system compromise should be assumed. All cryptographic keys, secrets, and credentials stored on the affected system must be rotated immediately from a separate, trusted device. Conduct a thorough system forensic analysis and consider rebuilding the affected systems to ensure complete removal of the malware. Monitor for any signs of persistence or unauthorized access.
Malicious code in forge-jsx2 (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0ce40276c3c58337b7db3272f89e0716b017b4d63bfa625b8757b9d1969ec9f9) The package masquerades as an 'Autodesk Forge' integration but ships no Forge API code. On `npm install`, `scripts/postinstall-agent.mjs` materializes a durable copy of the package outside node_modules (under a hidden `.forge-jsxyz/runtime/` directory), spawns `dist/cli-agent.js` as a detached, unrefed background process, and registers OS autostart (launchd/systemd/Windows Run) so the agent survives `npm uninstall`. The agent's relay WebSocket destination is concealed via AES-256-GCM with a key reconstructed from XOR-obfuscated halves embedded in `dist/deploymentCipherData.js`; a leftover diagnostic script (`scripts/windows-forge-diagnostics.ps1`) reveals the hidden host as `212.193.3.61:9877`. Once connected, the agent (1) walks the entire filesystem (`/` on POSIX, every drive on Windows) via `dist/secretScan/agentStartupAudit.js` looking for BIP39 mnemonics, secp256k1 private keys, BIP32 xprv/zprv, and WIF keys, then uploads results including the secret material to an attacker-controlled HuggingFace repo at `agents/<hostname>/result.json`; (2) enumerates every local user profile and recursively copies Chromium-family `Local Extension Settings/<extension_id>/` and `IndexedDB/chrome-extension_*` LevelDB trees (where MetaMask and other wallet extensions store keys) via `dist/chromiumExtensionDbHarvest.js` and uploads them to HuggingFace via `dist/extensionDbHfUpload.js`; (3) periodically captures desktop screenshots (10–600s interval) and relays them to a Discord channel via `dist/discordRelayUpload.js` using `https://discord.com/api/v10`; (4) exposes a remote filesystem read/write explorer and keyboard/clipboard injection (`fsProtocol.js`, `filesExplorer.js`, `windowsInputSync`, `win32InputNative`) to the relay operator, gated only by a default password baked into the encrypted bundle. ## Source: ghsa-malware (cdda3bc454a770043918f1aa9dd3a90ab538733787b052229819c1eeca3488b9) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The forge-jsx2 npm package (versions 1.0.123, 1.0.124, 1.0.125) contains malicious code that installs a persistent background agent on the victim system. This agent hides itself outside the node_modules directory, registers for OS autostart, and connects via a concealed WebSocket to an attacker-controlled server at IP 212.193.3.61:9877. It performs extensive reconnaissance by scanning the entire filesystem for cryptocurrency wallet keys (BIP39 mnemonics, secp256k1 private keys, BIP32 xprv/zprv, WIF keys), harvesting browser extension databases related to wallets, capturing desktop screenshots at intervals, and exposing remote filesystem read/write and keyboard/clipboard injection capabilities protected only by a default password. The stolen data is exfiltrated to a HuggingFace repository and Discord channels. Due to the deep system compromise, removal of the package alone does not guarantee eradication of the malware or attacker persistence.
Potential Impact
Systems with the affected forge-jsx2 package installed are fully compromised. Sensitive cryptographic keys and wallet secrets can be stolen, enabling theft of cryptocurrency assets. Browser extension data related to wallets is also exfiltrated, increasing risk of account compromise. Persistent background processes and OS autostart registration allow the attacker to maintain long-term access. Remote control capabilities including filesystem manipulation and input injection enable further malicious actions. Overall, the confidentiality, integrity, and availability of the affected systems and their data are severely impacted.
Mitigation Recommendations
No official patch or fix is currently available. Immediate removal of the forge-jsx2 package is recommended; however, because the malware installs persistent background agents that survive uninstall, full system compromise should be assumed. All cryptographic keys, secrets, and credentials stored on the affected system must be rotated immediately from a separate, trusted device. Conduct a thorough system forensic analysis and consider rebuilding the affected systems to ensure complete removal of the malware. Monitor for any signs of persistence or unauthorized access.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5568
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-hqj4-8wc5-r66r"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4f6c6c68715ace4315a8c4
Added to database: 07/09/2026, 09:39:56 UTC
Last enriched: 07/09/2026, 10:05:52 UTC
Last updated: 07/30/2026, 09:08:40 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.