Malicious code in twapfetch (npm)
The npm package twapfetch versions 1.1.0 and 1.1.1 include a postinstall script that downloads and executes arbitrary code from a mutable, author-controlled URL without any integrity verification. This behavior allows the package maintainer or an attacker who can alter the resolved URL to execute arbitrary code on the machine during installation. The package's advertised functionality does not match the shipped code, indicating a likely malicious intent to use the postinstall script as a dropper.
AI Analysis
Technical Summary
The twapfetch npm package versions 1.1.0 and 1.1.1 contain a postinstall script (scripts/install-check.cjs) that, upon npm install, fetches a tarball from a URL resolved via environment variables or the package.json homepage field. This tarball is extracted and installed locally, and its code is executed immediately. There is no version pinning, hash checking, or signature verification on the fetched bundle, enabling arbitrary code execution controlled by the package maintainer or anyone who can manipulate the URL. The actual code shipped does not implement the advertised TWAP WebSocket client functionality, instead exporting unrelated math helpers, suggesting the postinstall script is a malicious dropper.
Potential Impact
Arbitrary code execution occurs on the installer's machine during package installation, potentially allowing full compromise of the environment where npm install is run. This can lead to unauthorized access, data theft, or further malware deployment. The lack of integrity checks on the fetched code increases the risk of supply chain attacks.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing twapfetch versions 1.1.0 and 1.1.1. Until a fix or official advisory is released, do not use this package or any versions that include the described postinstall behavior. Monitor vendor advisories for updates and consider using alternative packages with verified integrity and trusted sources.
Malicious code in twapfetch (npm)
Description
The npm package twapfetch versions 1.1.0 and 1.1.1 include a postinstall script that downloads and executes arbitrary code from a mutable, author-controlled URL without any integrity verification. This behavior allows the package maintainer or an attacker who can alter the resolved URL to execute arbitrary code on the machine during installation. The package's advertised functionality does not match the shipped code, indicating a likely malicious intent to use the postinstall script as a dropper.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The twapfetch npm package versions 1.1.0 and 1.1.1 contain a postinstall script (scripts/install-check.cjs) that, upon npm install, fetches a tarball from a URL resolved via environment variables or the package.json homepage field. This tarball is extracted and installed locally, and its code is executed immediately. There is no version pinning, hash checking, or signature verification on the fetched bundle, enabling arbitrary code execution controlled by the package maintainer or anyone who can manipulate the URL. The actual code shipped does not implement the advertised TWAP WebSocket client functionality, instead exporting unrelated math helpers, suggesting the postinstall script is a malicious dropper.
Potential Impact
Arbitrary code execution occurs on the installer's machine during package installation, potentially allowing full compromise of the environment where npm install is run. This can lead to unauthorized access, data theft, or further malware deployment. The lack of integrity checks on the fetched code increases the risk of supply chain attacks.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing twapfetch versions 1.1.0 and 1.1.1. Until a fix or official advisory is released, do not use this package or any versions that include the described postinstall behavior. Monitor vendor advisories for updates and consider using alternative packages with verified integrity and trusted sources.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14197
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4c7acd9273b49252880
Added to database: 08/19/2026, 13:51:03 UTC
Last enriched: 08/19/2026, 14:42:17 UTC
Last updated: 08/19/2026, 14:42:17 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.