MalwarePublished 14 Aug 2026

@mexc/shared-utils (npm) · Malicious Code

Affects @mexc/shared-utilsSource GCVE Database

Malicious package : remove @mexc/shared-utils and rotate any secrets on hosts that installed it.

Data as of 15 Aug 2026, 15:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-14049

What to do

Remove @mexc/shared-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@mexc/shared-utils	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c6d793d1ff65b7f5a24e1aa0c176eaa5d83c7870e05cca5b64f22edb9ca7ded7) Package published to the public npm registry under the @mexc scope without evidence of scope ownership. package.json declares a postinstall hook ("postinstall": "node postinstall.js") that runs on any installer whose resolver falls back to the public registry when resolving @mexc/shared-utils. The postinstall script collects host metadata — os.hostname(), os.userInfo().username, process.getuid(), process.cwd(), platform, node version, and multiple npm_* environment variables (npm_config_registry, npm_config_user_agent, npm_execpath, INIT_CWD) — and writes the data to os.tmpdir()/mexc-poc-execution-proof.json. The current shipped script performs local write only with no outbound network call, but the install-time code-execution primitive against any CI/build system that resolves the @mexc scope publicly is the classic dependency-confusion pattern; the author controls the code that runs and can change the payload in any future version.

Impact

The immediate impact is limited to local collection of host metadata written to a temporary file during package installation. There is no current network communication or data exfiltration. However, the dependency confusion pattern allows the attacker to run arbitrary code at install time, which could be escalated in future versions to execute malicious payloads, potentially compromising CI/build environments that resolve this package from the public npm registry.

Defensive guidance

Users should avoid installing or resolving the @mexc/shared-utils package from the public npm registry, especially in CI/build environments. Verify ownership of the @mexc scope before trusting packages under it. Monitor dependency resolution configurations to prevent fallback to public registries for private scopes. Since the current payload performs only local writes, immediate risk is low, but caution is advised to prevent future malicious code execution.

Summary

The @mexc/shared-utils npm package version 1.0.0 includes a postinstall hook that runs automatically when the package is installed. This hook collects various host environment details and writes them to a local file in the temporary directory. The package was published to the public npm registry under the @mexc scope without evidence of legitimate scope ownership, indicating a dependency confusion attack vector. While the current payload only performs local data collection without network exfiltration, the attacker controls the code executed at install time and could update it to perform more harmful actions in the future. This creates a risk for any CI or build system that resolves the @mexc scope publicly and installs this package.

References

npmjs.com/package/@mexc/shared-utils/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Aug 2026, 05:42 UTC

Technical details

References

Community reviews