Malicious code in rpc-endpoint-rotator (npm)
The npm package 'rpc-endpoint-rotator' version 1.0.0 contains malicious code that, upon being required, unconditionally sends a POST request to an external URL. This request transmits the entire process environment variables along with OS hostname, username, and home directory information. The malicious behavior is hidden behind legitimate-looking exported helpers, and the code is described as a hidden periodic environment data beacon. This exfiltration can leak sensitive credentials such as cloud keys, CI tokens, and provider secrets present in the environment.
AI Analysis
Technical Summary
The 'rpc-endpoint-rotator' npm package version 1.0.0 includes top-level code in index.js that immediately sends a POST request to a remote endpoint (https://enjbyg3xk8l.x.pipedream.net/beacon) upon module load. This beacon transmits the entire process environment variables, OS hostname, username, and home directory, potentially exposing sensitive credentials. The package exports functions like keccak256, toChecksumAddress, and formatUnits as a cover, but the main malicious behavior is the hidden periodic environment data beacon. This behavior is unrelated to the package's advertised functionality of RPC endpoint rotation.
Potential Impact
Sensitive environment variables and system information are exfiltrated to an attacker-controlled endpoint whenever the package is loaded. This can lead to credential leakage including cloud service keys, continuous integration tokens, and other secrets stored in environment variables. Such leakage can compromise the security of systems and services that rely on these credentials.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove and avoid using version 1.0.0 of the 'rpc-endpoint-rotator' package. Review and rotate any credentials or secrets that may have been exposed due to this package. Monitor for any unauthorized access that could result from leaked credentials. Check the vendor or package repository for updates or official advisories regarding remediation.
Malicious code in rpc-endpoint-rotator (npm)
Description
The npm package 'rpc-endpoint-rotator' version 1.0.0 contains malicious code that, upon being required, unconditionally sends a POST request to an external URL. This request transmits the entire process environment variables along with OS hostname, username, and home directory information. The malicious behavior is hidden behind legitimate-looking exported helpers, and the code is described as a hidden periodic environment data beacon. This exfiltration can leak sensitive credentials such as cloud keys, CI tokens, and provider secrets present in the environment.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'rpc-endpoint-rotator' npm package version 1.0.0 includes top-level code in index.js that immediately sends a POST request to a remote endpoint (https://enjbyg3xk8l.x.pipedream.net/beacon) upon module load. This beacon transmits the entire process environment variables, OS hostname, username, and home directory, potentially exposing sensitive credentials. The package exports functions like keccak256, toChecksumAddress, and formatUnits as a cover, but the main malicious behavior is the hidden periodic environment data beacon. This behavior is unrelated to the package's advertised functionality of RPC endpoint rotation.
Potential Impact
Sensitive environment variables and system information are exfiltrated to an attacker-controlled endpoint whenever the package is loaded. This can lead to credential leakage including cloud service keys, continuous integration tokens, and other secrets stored in environment variables. Such leakage can compromise the security of systems and services that rely on these credentials.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove and avoid using version 1.0.0 of the 'rpc-endpoint-rotator' package. Review and rotate any credentials or secrets that may have been exposed due to this package. Monitor for any unauthorized access that could result from leaked credentials. Check the vendor or package repository for updates or official advisories regarding remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12431
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a735744bf8831d539159c7c
Added to database: 08/05/2026, 15:31:16 UTC
Last enriched: 08/05/2026, 17:19:11 UTC
Last updated: 09/07/2026, 22:30:31 UTC
Views: 20
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.