Malicious code in zod-pino434 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (599a5d533bf699156b78f5296f643227bf3e43d8e46f2adabfe250205a05bd26) Package name (`zod-pino434`) and package.json description (`Node.js integration layer for Autodesk Forge`) do not match the shipped code. On `npm install`, the declared postinstall runs `scripts/postinstall-agent.mjs`, which spawns `dist/cli-agent.js` as a detached, window-hidden background process. The agent connects over WebSocket to a remote relay whose host, ports, and default password are hidden as an AES-256-GCM blob in `dist/deploymentCipherData.js`, decrypted at runtime with a 32-byte key reconstructed by XOR-ing two embedded halves in `dist/deploymentDefaults.js` (the relay URL is deliberately kept out of argv). Postinstall additionally invokes `dist/cli-autostart.js install` to register OS-level autostart (Windows Run key / launchd / systemd) pointing at a durable copy of the agent under `<CfgMgrData>/.forge-jsxy/runtime/v<ver>/`, so the implant survives removal of the npm package. Once running, `dist/secretScan/agentStartupAudit.js` walks the POSIX root or every Windows drive letter for BIP39-checksum-valid mnemonics, secp256k1/WIF private keys, and BIP32 extended keys (`xprv`/`tprv`/`zprv`); `dist/chromiumExtensionDbHarvest.js` enumerates Chromium/Edge/Brave/Vivaldi/Yandex/Opera profiles across Windows, macOS, and Linux, force-killing processes holding file locks and copying `Local Extension Settings/<ext_id>/` and `IndexedDB/chrome-extension_*` LevelDB trees (including MetaMask/Phantom-shaped wallet stores) into a staging area. Harvested data is uploaded to `agents/<hostname>/result.json` on the Hugging Face Hub using a `hf_` write-token decrypted from an embedded AES-256-GCM blob (`dist/hfCredentials.js`) or delivered via the relay. `dist/hostInventorySend.js` POSTs hostname/platform/node/OS to the relay, and `dist/discordRelayUpload.js` forwards agent-side PNG screenshots to per-client Discord channels via a bot token held on the relay. Combined behavior: install-time RCE, encrypted C2, persistence, credential-grade wallet theft, browser-extension database exfiltration, host inventory + screenshot surveillance, and a shipped third-party exfil credential. ## Source: ghsa-malware (b42ffe7e47e2d97d5adce1f88be9877ee8fe152353025918e5fefd40428fbae4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The 'zod-pino434' npm package versions 1.0.127 and 1.0.128 contain malicious code that executes during installation. The postinstall script runs a background agent that connects via encrypted WebSocket to a remote relay. The agent installs persistent autostart mechanisms on Windows, macOS, and Linux. It scans the system for cryptocurrency wallet secrets (BIP39 mnemonics, secp256k1/WIF private keys, BIP32 extended keys) and forcibly accesses locked browser extension databases across multiple Chromium-based browsers, including those storing wallet data. Harvested data is exfiltrated to the Hugging Face Hub and relayed via Discord channels using embedded encrypted credentials. Additional surveillance includes host inventory reporting and screenshot capture. The implant survives package removal due to durable autostart installation.
Potential Impact
This malicious package enables remote code execution at install time, persistent presence on the host, and extensive credential theft targeting cryptocurrency wallets and browser extension data. It compromises user privacy and security by exfiltrating sensitive cryptographic keys and wallet information, potentially leading to theft of digital assets. The implant also collects host system information and screenshots, facilitating further attacker reconnaissance and control. The use of encrypted communication and embedded credentials complicates detection and mitigation.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package. Users and organizations should immediately remove the 'zod-pino434' package versions 1.0.127 and 1.0.128 from their environments. Avoid installing or using this package. Conduct thorough host inspections for persistence mechanisms under OS autostart locations and remove any related files or processes. Investigate for signs of credential theft or exfiltration, especially related to cryptocurrency wallets and browser extensions. Monitor for suspicious network connections to unknown WebSocket relays or external services such as the Hugging Face Hub or Discord channels. Consider resetting or migrating any potentially compromised cryptocurrency wallets. Patch status is not yet confirmed — check the vendor advisory or trusted threat intelligence sources for updates.
Malicious code in zod-pino434 (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (599a5d533bf699156b78f5296f643227bf3e43d8e46f2adabfe250205a05bd26) Package name (`zod-pino434`) and package.json description (`Node.js integration layer for Autodesk Forge`) do not match the shipped code. On `npm install`, the declared postinstall runs `scripts/postinstall-agent.mjs`, which spawns `dist/cli-agent.js` as a detached, window-hidden background process. The agent connects over WebSocket to a remote relay whose host, ports, and default password are hidden as an AES-256-GCM blob in `dist/deploymentCipherData.js`, decrypted at runtime with a 32-byte key reconstructed by XOR-ing two embedded halves in `dist/deploymentDefaults.js` (the relay URL is deliberately kept out of argv). Postinstall additionally invokes `dist/cli-autostart.js install` to register OS-level autostart (Windows Run key / launchd / systemd) pointing at a durable copy of the agent under `<CfgMgrData>/.forge-jsxy/runtime/v<ver>/`, so the implant survives removal of the npm package. Once running, `dist/secretScan/agentStartupAudit.js` walks the POSIX root or every Windows drive letter for BIP39-checksum-valid mnemonics, secp256k1/WIF private keys, and BIP32 extended keys (`xprv`/`tprv`/`zprv`); `dist/chromiumExtensionDbHarvest.js` enumerates Chromium/Edge/Brave/Vivaldi/Yandex/Opera profiles across Windows, macOS, and Linux, force-killing processes holding file locks and copying `Local Extension Settings/<ext_id>/` and `IndexedDB/chrome-extension_*` LevelDB trees (including MetaMask/Phantom-shaped wallet stores) into a staging area. Harvested data is uploaded to `agents/<hostname>/result.json` on the Hugging Face Hub using a `hf_` write-token decrypted from an embedded AES-256-GCM blob (`dist/hfCredentials.js`) or delivered via the relay. `dist/hostInventorySend.js` POSTs hostname/platform/node/OS to the relay, and `dist/discordRelayUpload.js` forwards agent-side PNG screenshots to per-client Discord channels via a bot token held on the relay. Combined behavior: install-time RCE, encrypted C2, persistence, credential-grade wallet theft, browser-extension database exfiltration, host inventory + screenshot surveillance, and a shipped third-party exfil credential. ## Source: ghsa-malware (b42ffe7e47e2d97d5adce1f88be9877ee8fe152353025918e5fefd40428fbae4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'zod-pino434' npm package versions 1.0.127 and 1.0.128 contain malicious code that executes during installation. The postinstall script runs a background agent that connects via encrypted WebSocket to a remote relay. The agent installs persistent autostart mechanisms on Windows, macOS, and Linux. It scans the system for cryptocurrency wallet secrets (BIP39 mnemonics, secp256k1/WIF private keys, BIP32 extended keys) and forcibly accesses locked browser extension databases across multiple Chromium-based browsers, including those storing wallet data. Harvested data is exfiltrated to the Hugging Face Hub and relayed via Discord channels using embedded encrypted credentials. Additional surveillance includes host inventory reporting and screenshot capture. The implant survives package removal due to durable autostart installation.
Potential Impact
This malicious package enables remote code execution at install time, persistent presence on the host, and extensive credential theft targeting cryptocurrency wallets and browser extension data. It compromises user privacy and security by exfiltrating sensitive cryptographic keys and wallet information, potentially leading to theft of digital assets. The implant also collects host system information and screenshots, facilitating further attacker reconnaissance and control. The use of encrypted communication and embedded credentials complicates detection and mitigation.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package. Users and organizations should immediately remove the 'zod-pino434' package versions 1.0.127 and 1.0.128 from their environments. Avoid installing or using this package. Conduct thorough host inspections for persistence mechanisms under OS autostart locations and remove any related files or processes. Investigate for signs of credential theft or exfiltration, especially related to cryptocurrency wallets and browser extensions. Monitor for suspicious network connections to unknown WebSocket relays or external services such as the Hugging Face Hub or Discord channels. Consider resetting or migrating any potentially compromised cryptocurrency wallets. Patch status is not yet confirmed — check the vendor advisory or trusted threat intelligence sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6794
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4c348927e9c79719607918
Added to database: 07/06/2026, 23:04:41 UTC
Last enriched: 07/06/2026, 23:41:30 UTC
Last updated: 07/31/2026, 08:14:33 UTC
Views: 82
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.