Malicious code in forge-jsx4 (npm)
forge-jsx4 is a remote access trojan (RAT) published to the public npm registry by the account rafael_silva ([email protected]). Versions 1.0.122 and 1.0.123 were published on June 21-22, 2026 as a reconstitution of the forge-jsx / forge-jsxy campaign, reusing the same command-and-control infrastructure and encryption after the earlier packages were taken down. The malware executes through a postinstall hook chain ("node scripts/postinstall-clipboard-event.mjs && node scripts/ensure-dist.mjs && node scripts/postinstall-durable-materialize.mjs && node scripts/postinstall-bootstrap.mjs && node scripts/postinstall-agent.mjs"), which runs automatically on npm install and skips CI environments to evade analysis. Once running it deploys a full RAT: system-wide keylogging via uiohook-napi, clipboard monitoring, .env file scanning, shell history collection, host inventory enumeration, desktop screenshot capture via jimp, and a WebSocket filesystem backdoor with remote file access. It scans the filesystem for cryptocurrency material (BIP39 mnemonics validated via checksum, Ed25519 Solana keypairs via tweetnacl, range-checked secp256k1 keys) and harvests browser-extension wallet databases across 21+ Chromium browsers (MetaMask, Phantom, Rabby). It establishes durable persistence outside node_modules (e.g. ~/.local/share/cfgmgr/.forge-jsxy/ on Linux, with macOS/Windows equivalents) plus autostart services (systemd user unit forge-js-worker.service, macOS LaunchAgent com.forgejs.worker.plist, Windows Task Scheduler ForgeJSWorker / HKCU Run key), so it survives npm uninstall, and supports relay-pushed auto-upgrades. Collected data is exfiltrated to a hardcoded C2 at 204.10.194.247 (WebSocket relay ws://204.10.194.247:9877, HTTP API http://204.10.194.247:8765, session password "secret"), to Discord bot webhooks (screenshots via ephemeral URLs), and to Hugging Face Hub repositories via the @huggingface/hub SDK. The payload uses an XOR-obfuscated AES-256-GCM key shared across all campaign waves. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (54ce6747205bbecab342f78d9558861a02c1e21a213d795237b788cb3552a3c0) Package ships several files with patterns that warrant human inspection: a `scripts/postinstall-agent.mjs` invoked at install time, a `dist/discordRelayUpload.js` module with POST/ping/base64 patterns, a `dist/relayServer.js`, a `dist/secretScan/agentStartupAudit.js` that fetches from huggingface.co, and a `dist/hfCredentials.js` with base64 decode operations. The combination of an install-time agent script plus a relay/upload module plus a credentials helper is the kind of composition that can hide an installer-side data flow, but the package name (`forge-jsx4`) and the file naming suggest a developer-tool / agent / Hugging Face integration where many of these patterns may be legitimate (HF API endpoints, content-scanning helpers, build artifact relay). Without traced-code corroboration of where the postinstall agent points, what discordRelayUpload actually transmits, and whose credentials hfCredentials handles, the intent cannot be confirmed. Routing to human review so a maintainer can verify whether the postinstall script performs an outbound fetch to an attacker-controlled destination, whether discordRelayUpload silently exfiltrates caller-supplied data, and whether the embedded base64 blobs decode to executable payloads or to legitimate configuration.
AI Analysis
Technical Summary
The forge-jsx4 npm package versions 1.0.122 and 1.0.123 contain a remote access trojan that activates through a postinstall hook chain executed automatically on npm install, except in CI environments. This RAT includes system-wide keylogging via uiohook-napi, clipboard monitoring, scanning for .env files and shell history, host inventory enumeration, desktop screenshot capture using jimp, and a WebSocket filesystem backdoor enabling remote file access. It specifically scans for cryptocurrency-related data such as BIP39 mnemonics, Ed25519 Solana keypairs, and secp256k1 keys, and harvests wallet databases from over 21 Chromium-based browsers including MetaMask, Phantom, and Rabby. The malware establishes durable persistence by placing files outside the node_modules directory and creating autostart services on Linux (systemd user unit), macOS (LaunchAgent), and Windows (Task Scheduler and registry Run key), allowing it to survive npm uninstall and support auto-upgrades. Collected data is exfiltrated to a hardcoded C2 server via WebSocket and HTTP, to Discord bot webhooks, and to Hugging Face Hub repositories using the @huggingface/hub SDK. The encryption key for the payload is XOR-obfuscated AES-256-GCM, reused across campaign waves. The package was published by the account rafael_silva and is a reconstitution of a prior campaign involving forge-jsx and forge-jsxy. No official patch or remediation is indicated in the data.
Potential Impact
This malicious package compromises affected systems by deploying a full-featured remote access trojan that can capture sensitive user inputs (keylogging), monitor clipboard contents, scan environment and shell history files, enumerate host details, capture screenshots, and provide remote filesystem access. It targets cryptocurrency wallet data and browser extension wallets, risking theft of digital assets. The malware establishes persistence mechanisms that survive uninstallation of the npm package, increasing the difficulty of removal. Data exfiltration to attacker-controlled infrastructure and third-party services enables ongoing attacker control and data theft. There is no indication of known exploits in the wild beyond the package publication, but the capabilities pose a high risk to confidentiality and system integrity.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. The vendor advisory does not provide a fix or mitigation guidance. Users should avoid installing forge-jsx4 versions 1.0.122 and 1.0.123 from the npm registry. If already installed, manual investigation and removal of the persistence mechanisms and related files outside node_modules is required. Monitoring for suspicious postinstall scripts and auditing npm packages before installation is recommended to prevent infection. Since the malware skips CI environments, automated build pipelines may not detect it, so manual review is critical. Check for any network connections to the hardcoded C2 IP 204.10.194.247 and related indicators. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Malicious code in forge-jsx4 (npm)
Description
forge-jsx4 is a remote access trojan (RAT) published to the public npm registry by the account rafael_silva ([email protected]). Versions 1.0.122 and 1.0.123 were published on June 21-22, 2026 as a reconstitution of the forge-jsx / forge-jsxy campaign, reusing the same command-and-control infrastructure and encryption after the earlier packages were taken down. The malware executes through a postinstall hook chain ("node scripts/postinstall-clipboard-event.mjs && node scripts/ensure-dist.mjs && node scripts/postinstall-durable-materialize.mjs && node scripts/postinstall-bootstrap.mjs && node scripts/postinstall-agent.mjs"), which runs automatically on npm install and skips CI environments to evade analysis. Once running it deploys a full RAT: system-wide keylogging via uiohook-napi, clipboard monitoring, .env file scanning, shell history collection, host inventory enumeration, desktop screenshot capture via jimp, and a WebSocket filesystem backdoor with remote file access. It scans the filesystem for cryptocurrency material (BIP39 mnemonics validated via checksum, Ed25519 Solana keypairs via tweetnacl, range-checked secp256k1 keys) and harvests browser-extension wallet databases across 21+ Chromium browsers (MetaMask, Phantom, Rabby). It establishes durable persistence outside node_modules (e.g. ~/.local/share/cfgmgr/.forge-jsxy/ on Linux, with macOS/Windows equivalents) plus autostart services (systemd user unit forge-js-worker.service, macOS LaunchAgent com.forgejs.worker.plist, Windows Task Scheduler ForgeJSWorker / HKCU Run key), so it survives npm uninstall, and supports relay-pushed auto-upgrades. Collected data is exfiltrated to a hardcoded C2 at 204.10.194.247 (WebSocket relay ws://204.10.194.247:9877, HTTP API http://204.10.194.247:8765, session password "secret"), to Discord bot webhooks (screenshots via ephemeral URLs), and to Hugging Face Hub repositories via the @huggingface/hub SDK. The payload uses an XOR-obfuscated AES-256-GCM key shared across all campaign waves. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (54ce6747205bbecab342f78d9558861a02c1e21a213d795237b788cb3552a3c0) Package ships several files with patterns that warrant human inspection: a `scripts/postinstall-agent.mjs` invoked at install time, a `dist/discordRelayUpload.js` module with POST/ping/base64 patterns, a `dist/relayServer.js`, a `dist/secretScan/agentStartupAudit.js` that fetches from huggingface.co, and a `dist/hfCredentials.js` with base64 decode operations. The combination of an install-time agent script plus a relay/upload module plus a credentials helper is the kind of composition that can hide an installer-side data flow, but the package name (`forge-jsx4`) and the file naming suggest a developer-tool / agent / Hugging Face integration where many of these patterns may be legitimate (HF API endpoints, content-scanning helpers, build artifact relay). Without traced-code corroboration of where the postinstall agent points, what discordRelayUpload actually transmits, and whose credentials hfCredentials handles, the intent cannot be confirmed. Routing to human review so a maintainer can verify whether the postinstall script performs an outbound fetch to an attacker-controlled destination, whether discordRelayUpload silently exfiltrates caller-supplied data, and whether the embedded base64 blobs decode to executable payloads or to legitimate configuration.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The forge-jsx4 npm package versions 1.0.122 and 1.0.123 contain a remote access trojan that activates through a postinstall hook chain executed automatically on npm install, except in CI environments. This RAT includes system-wide keylogging via uiohook-napi, clipboard monitoring, scanning for .env files and shell history, host inventory enumeration, desktop screenshot capture using jimp, and a WebSocket filesystem backdoor enabling remote file access. It specifically scans for cryptocurrency-related data such as BIP39 mnemonics, Ed25519 Solana keypairs, and secp256k1 keys, and harvests wallet databases from over 21 Chromium-based browsers including MetaMask, Phantom, and Rabby. The malware establishes durable persistence by placing files outside the node_modules directory and creating autostart services on Linux (systemd user unit), macOS (LaunchAgent), and Windows (Task Scheduler and registry Run key), allowing it to survive npm uninstall and support auto-upgrades. Collected data is exfiltrated to a hardcoded C2 server via WebSocket and HTTP, to Discord bot webhooks, and to Hugging Face Hub repositories using the @huggingface/hub SDK. The encryption key for the payload is XOR-obfuscated AES-256-GCM, reused across campaign waves. The package was published by the account rafael_silva and is a reconstitution of a prior campaign involving forge-jsx and forge-jsxy. No official patch or remediation is indicated in the data.
Potential Impact
This malicious package compromises affected systems by deploying a full-featured remote access trojan that can capture sensitive user inputs (keylogging), monitor clipboard contents, scan environment and shell history files, enumerate host details, capture screenshots, and provide remote filesystem access. It targets cryptocurrency wallet data and browser extension wallets, risking theft of digital assets. The malware establishes persistence mechanisms that survive uninstallation of the npm package, increasing the difficulty of removal. Data exfiltration to attacker-controlled infrastructure and third-party services enables ongoing attacker control and data theft. There is no indication of known exploits in the wild beyond the package publication, but the capabilities pose a high risk to confidentiality and system integrity.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. The vendor advisory does not provide a fix or mitigation guidance. Users should avoid installing forge-jsx4 versions 1.0.122 and 1.0.123 from the npm registry. If already installed, manual investigation and removal of the persistence mechanisms and related files outside node_modules is required. Monitoring for suspicious postinstall scripts and auditing npm packages before installation is recommended to prevent infection. Since the malware skips CI environments, automated build pipelines may not detect it, so manual review is critical. Check for any network connections to the hardcoded C2 IP 204.10.194.247 and related indicators. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6279
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50ba5968715ace4357ef5e
Added to database: 07/10/2026, 09:24:41 UTC
Last enriched: 07/10/2026, 09:44:26 UTC
Last updated: 07/28/2026, 04:35:02 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.