Malicious code in @wizloft/harness-context (npm)
The npm package @wizloft/harness-context version 0.1.1-alpha.3 contains malicious code embedded in its main file dist/index.js. This code is heavily obfuscated and, upon import, performs unauthorized HTTPS requests to an Ethereum public RPC endpoint and a block-explorer API. It uses blockchain contract state to dynamically retrieve and execute additional arbitrary code within the importing process. This behavior is unrelated to the package's advertised functionality and represents a supply chain compromise via the EtherHiding loader pattern.
AI Analysis
Technical Summary
The @wizloft/harness-context npm package version 0.1.1-alpha.3 includes a malicious payload hidden in an obfuscated Immediately Invoked Function Expression (IIFE) appended to its legitimate code. When imported, it stores references to Node.js globals and makes HTTPS POST requests to an Ethereum RPC endpoint (h.drpc.org) and a blockchain explorer API to read the state of a specific Ethereum contract (0xa322E5f3...). The contract state is used as a pointer to a next-stage URL, which is fetched and executed dynamically in the same process. This EtherHiding loader technique allows attacker-controlled blockchain data to direct arbitrary code execution at require time, deviating from the package's intended purpose as a typed capability contract.
Potential Impact
This malicious code enables remote code execution within any environment that imports the affected package version, potentially allowing attackers to run arbitrary code controlled via the Ethereum blockchain contract state. This compromises the integrity and security of the consuming application and environment. No known exploits in the wild have been reported yet.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package version. Users should avoid using @wizloft/harness-context version 0.1.1-alpha.3 and remove it from their dependencies if present. Consider auditing your supply chain and replacing this package with a trusted alternative. Monitor vendor advisories for any updates or official fixes.
Malicious code in @wizloft/harness-context (npm)
Description
The npm package @wizloft/harness-context version 0.1.1-alpha.3 contains malicious code embedded in its main file dist/index.js. This code is heavily obfuscated and, upon import, performs unauthorized HTTPS requests to an Ethereum public RPC endpoint and a block-explorer API. It uses blockchain contract state to dynamically retrieve and execute additional arbitrary code within the importing process. This behavior is unrelated to the package's advertised functionality and represents a supply chain compromise via the EtherHiding loader pattern.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @wizloft/harness-context npm package version 0.1.1-alpha.3 includes a malicious payload hidden in an obfuscated Immediately Invoked Function Expression (IIFE) appended to its legitimate code. When imported, it stores references to Node.js globals and makes HTTPS POST requests to an Ethereum RPC endpoint (h.drpc.org) and a blockchain explorer API to read the state of a specific Ethereum contract (0xa322E5f3...). The contract state is used as a pointer to a next-stage URL, which is fetched and executed dynamically in the same process. This EtherHiding loader technique allows attacker-controlled blockchain data to direct arbitrary code execution at require time, deviating from the package's intended purpose as a typed capability contract.
Potential Impact
This malicious code enables remote code execution within any environment that imports the affected package version, potentially allowing attackers to run arbitrary code controlled via the Ethereum blockchain contract state. This compromises the integrity and security of the consuming application and environment. No known exploits in the wild have been reported yet.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package version. Users should avoid using @wizloft/harness-context version 0.1.1-alpha.3 and remove it from their dependencies if present. Consider auditing your supply chain and replacing this package with a trusted alternative. Monitor vendor advisories for any updates or official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14286
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4b4acd9273b4925152f
Added to database: 08/19/2026, 13:50:44 UTC
Last enriched: 08/19/2026, 14:14:46 UTC
Last updated: 08/19/2026, 14:14:46 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.