MalwarePublished 13 Aug 2026

mutex-forge (npm) · Malicious Code

Affects mutex-forgeSource GCVE Database

Malicious package : remove mutex-forge and rotate any secrets on hosts that installed it.

Data as of 14 Aug 2026, 16:47 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13955

What to do

Remove mutex-forge from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmmutex-forge	Affected =2.0.1 =2.0.2 =2.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package mutex-forge versions 2.0.0, 2.0.1, and 2.0.2 contains malicious code that acts as a multi-stage loader. It performs host reconnaissance and exfiltrates data to hardcoded Telegram and Slack channels using embedded bot tokens. It also downloads and executes additional payloads from an Ethereum smart contract, establishing persistent remote command and control. The malware attempts to cover its tracks by deleting its components and modifying its own source code after execution. Any system with this package installed should be considered fully compromised.

Impact

Systems with mutex-forge versions 2.0.0, 2.0.1, or 2.0.2 installed are fully compromised. The attacker gains remote code execution, persistent control, and exfiltration capabilities. All secrets and keys on the compromised system should be considered exposed and rotated immediately. Removing the package alone does not guarantee removal of all malicious components due to the persistence mechanisms employed.

Defensive guidance

Immediate removal of mutex-forge versions 2.0.0, 2.0.1, and 2.0.2 is strongly recommended. All credentials and secrets stored on affected systems should be rotated from a secure, uncompromised environment. Due to the persistence and cleanup behavior of the malware, a full system compromise should be assumed, and affected systems should be thoroughly investigated and rebuilt if necessary.

Summary

The mutex-forge npm package masquerades as a mutex/semaphore library but contains a hidden multi-stage malicious loader. When triggered by a specific callback, it collects detailed host information and sends it to attacker-controlled Telegram and Slack channels using embedded bot tokens. It connects to the Ethereum Sepolia network to retrieve encrypted payloads from a smart contract, decrypts them using AES-GCM with an X25519-derived key, writes them to disk, and executes them. A persistent remote command channel is established by polling Slack API for attacker commands, decrypting and executing them. The malware cleans up by deleting its loader files and rewriting its source code to remove the malicious trigger, attempting to evade detection. Live third-party bot tokens and network destinations are embedded in obfuscated form within the payload.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 16:47 UTC

Technical details

References

Community reviews