MalwarePublished 16 Sep 2025Updated 30 Oct 2025

@openzeppelin-compact/utils (npm) · Malicious Code

Affects @openzeppelin-compact/utilsSource GCVE Database

Malicious package : remove @openzeppelin-compact/utils and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 22:57 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-47252

What to do

Remove @openzeppelin-compact/utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@openzeppelin-compact/utils	Affected =0.24.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @openzeppelin-compact/utils npm package version 0.24.0 contains malicious code that installs a dependency from a custom domain which executes an information stealer during installation. This malware targets sensitive tokens related to npm, git, and CI/CD environments. Systems with this package installed should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a separate, trusted machine.

Impact

Systems with the malicious @openzeppelin-compact/utils package installed are fully compromised. Attackers may have stolen npm, git, and CI/CD tokens, which can lead to unauthorized access to source code repositories, build pipelines, and deployment environments. This can result in further compromise of development infrastructure and leakage of sensitive information. Immediate secret rotation is required to mitigate ongoing risk.

Defensive guidance

Remove the @openzeppelin-compact/utils package version 0.24.0 from all affected systems. Consider all machines with this package installed as fully compromised. Rotate all secrets, tokens, and keys (npm, git, CI/CD) from a separate, secure machine. Conduct a thorough investigation and remediation of the affected systems to identify and remove any additional malware or backdoors. Do not rely solely on package removal to restore security.

Summary

The @openzeppelin-compact/utils package at version 0.24.0 is identified as malicious. During installation, it pulls a dependency hosted on a custom domain that runs an info stealer. This malware specifically targets tokens used in npm, git, and CI/CD pipelines, potentially exposing critical credentials and secrets. The presence of this package on a system implies full compromise, with the attacker potentially having control over the machine. Removal of the package alone does not guarantee eradication of the malware or attacker persistence.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 22:57 UTC

Technical details

References

Community reviews