Malicious code in @openzeppelin-4/contracts (npm)
@openzeppelin-4/contracts is a malicious npm package published by npm account `mssjeep843` that impersonates OpenZeppelin's `@openzeppelin/contracts` (the v4 line) via the look-alike scope `@openzeppelin-4`, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — only an install-time payload (index.js) run via preinstall/postinstall that harvests credential-shaped environment variables and reads and exfiltrates SSH private keys, cloud credentials (AWS/GCP/Kubernetes/Docker), Solana/Anchor/NEAR/Sui wallet keys, Foundry keystores, `.git-credentials` and local `.env` files to `https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09`. It is one of a series of DeFi/crypto impersonation packages from the same account sharing this webhook.site endpoint, which also squat Aerodrome Finance, Camelot AMM, Euler EVC, BoringVault and Uniswap Permit2. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2841eb854dad391b8cf3d290704a888d5ac186a1f51aec84594eaa09acdfeb68) Package name @openzeppelin-4/contracts impersonates the @openzeppelin/contracts scope but ships no Solidity contracts — only index.js, executed via lifecycle scripts. index.js enumerates process.env for credential-shaped keys (KEY, TOKEN, SECRET, AWS, GITHUB, NPM, MNEMONIC, WALLET, INFURA, etc.), reads installer secret files including ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.kube/config, ~/.docker/config.json, ~/.netrc, ~/.npmrc, ~/.gitconfig, ~/.git-credentials, gcloud application default credentials, Solana/Anchor/Sui keys, Foundry keystores, and project.env files, then POSTs the collected data to https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09. Delivery uses spawn(process.execPath, ['-e', src], { detached: true, stdio: 'ignore' }) with a randomized 60–240 second delay, and the script bails out when the hostname or username matches sandbox/scanner patterns (scan-, detonation, sandbox, ubuntu-fc-uvm) or when canary env markers are present, evading install-time analysis.
AI Analysis
Technical Summary
The '@openzeppelin-4/contracts' npm package is a malicious package impersonating the legitimate '@openzeppelin/contracts' scope. Instead of providing Solidity contracts, it includes an index.js script executed during lifecycle events that enumerates environment variables for credential-like keys and reads various secret files such as AWS credentials, SSH keys, Kubernetes configs, Docker configs, npm and git credentials, cloud application credentials, blockchain keystores, and project environment files. The collected data is exfiltrated via an HTTP POST request to a remote webhook URL. The script uses a randomized delay between 60 and 240 seconds before execution and avoids running if it detects sandbox or scanning environments by checking hostnames, usernames, and environment markers, thereby evading install-time analysis.
Potential Impact
This malicious package can lead to the theft of a wide range of sensitive credentials and secret files from the victim's environment, including cloud service keys, SSH private keys, blockchain wallets, and other configuration files. This exposure can result in unauthorized access to cloud accounts, source code repositories, blockchain assets, and other critical infrastructure. The evasion techniques reduce the likelihood of detection during automated scans.
Mitigation Recommendations
Users should avoid installing packages from untrusted or suspicious sources, especially those impersonating well-known packages. Verify package names and scopes carefully before installation. Remove any installations of '@openzeppelin-4/contracts' versions 1.0.0 and 1.0.1. Since no official patch or remediation is provided, manual removal and credential rotation are recommended. Monitor for any unauthorized access using compromised credentials and consider revoking and regenerating secrets that may have been exposed.
Malicious code in @openzeppelin-4/contracts (npm)
Description
@openzeppelin-4/contracts is a malicious npm package published by npm account `mssjeep843` that impersonates OpenZeppelin's `@openzeppelin/contracts` (the v4 line) via the look-alike scope `@openzeppelin-4`, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — only an install-time payload (index.js) run via preinstall/postinstall that harvests credential-shaped environment variables and reads and exfiltrates SSH private keys, cloud credentials (AWS/GCP/Kubernetes/Docker), Solana/Anchor/NEAR/Sui wallet keys, Foundry keystores, `.git-credentials` and local `.env` files to `https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09`. It is one of a series of DeFi/crypto impersonation packages from the same account sharing this webhook.site endpoint, which also squat Aerodrome Finance, Camelot AMM, Euler EVC, BoringVault and Uniswap Permit2. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2841eb854dad391b8cf3d290704a888d5ac186a1f51aec84594eaa09acdfeb68) Package name @openzeppelin-4/contracts impersonates the @openzeppelin/contracts scope but ships no Solidity contracts — only index.js, executed via lifecycle scripts. index.js enumerates process.env for credential-shaped keys (KEY, TOKEN, SECRET, AWS, GITHUB, NPM, MNEMONIC, WALLET, INFURA, etc.), reads installer secret files including ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.kube/config, ~/.docker/config.json, ~/.netrc, ~/.npmrc, ~/.gitconfig, ~/.git-credentials, gcloud application default credentials, Solana/Anchor/Sui keys, Foundry keystores, and project.env files, then POSTs the collected data to https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09. Delivery uses spawn(process.execPath, ['-e', src], { detached: true, stdio: 'ignore' }) with a randomized 60–240 second delay, and the script bails out when the hostname or username matches sandbox/scanner patterns (scan-, detonation, sandbox, ubuntu-fc-uvm) or when canary env markers are present, evading install-time analysis.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The '@openzeppelin-4/contracts' npm package is a malicious package impersonating the legitimate '@openzeppelin/contracts' scope. Instead of providing Solidity contracts, it includes an index.js script executed during lifecycle events that enumerates environment variables for credential-like keys and reads various secret files such as AWS credentials, SSH keys, Kubernetes configs, Docker configs, npm and git credentials, cloud application credentials, blockchain keystores, and project environment files. The collected data is exfiltrated via an HTTP POST request to a remote webhook URL. The script uses a randomized delay between 60 and 240 seconds before execution and avoids running if it detects sandbox or scanning environments by checking hostnames, usernames, and environment markers, thereby evading install-time analysis.
Potential Impact
This malicious package can lead to the theft of a wide range of sensitive credentials and secret files from the victim's environment, including cloud service keys, SSH private keys, blockchain wallets, and other configuration files. This exposure can result in unauthorized access to cloud accounts, source code repositories, blockchain assets, and other critical infrastructure. The evasion techniques reduce the likelihood of detection during automated scans.
Mitigation Recommendations
Users should avoid installing packages from untrusted or suspicious sources, especially those impersonating well-known packages. Verify package names and scopes carefully before installation. Remove any installations of '@openzeppelin-4/contracts' versions 1.0.0 and 1.0.1. Since no official patch or remediation is provided, manual removal and credential rotation are recommended. Monitor for any unauthorized access using compromised credentials and consider revoking and regenerating secrets that may have been exposed.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13737
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a7b6fd9bf8831d5393eb02e
Added to database: 08/11/2026, 18:54:17 UTC
Last enriched: 08/11/2026, 19:04:46 UTC
Last updated: 09/25/2026, 16:06:52 UTC
Views: 32
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.