{"id":"MAL-2026-5978","summary":"Malicious code in cryptodao-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (97e08a5a6fa93f0080d53371f566846f4258ed5e50479f43b9fc10c7a9716410)\npackage.json declares `postinstall: node recon.js`, which runs automatically on every `npm install`. recon.js harvests host information and a curated list of credential-bearing environment variables (AWS_SECRET_ACCESS_KEY, NPM_TOKEN, GITLAB_ACCESS_TOKEN, CI_JOB_TOKEN, SSH_PRIVATE_KEY, DB_PASSWORD, PRIVATE_KEY, MNEMONIC, SEED_PHRASE, DOCKER_PASSWORD, and others), grep-reads.env files at common installer paths for KEY/SECRET/TOKEN/PASS/PRIVATE/MNEMONIC lines, and POSTs the collected bundle to two attacker-controlled endpoints: `https://webhook.site/d6d18927-e513-4df7-b019-58bfc64fe0dd` and `https://enqoojbegdvxj.x.pipedream.net/`. The HTTPS requests are issued with `rejectUnauthorized: false`, disabling certificate validation so exfiltration succeeds through TLS-intercepting proxies. The package self-identifies in source comments as a 'CryptoDAO Dependency Confusion Reconnaissance Payload' and is published at version 99.99.99 — the canonical shape used to outrank an internal `cryptodao-utils` package during registry resolution. Combined, this is a complete dependency-confusion credential-harvest attack against any installer whose build pipeline resolves the public name.\n\n## Source: ossf-package-analysis (fb6683ae60f6a98342ecd5399e61fbcbde57eebadc193eaa484d7adde2318bea)\nThe OpenSSF Package Analysis project identified 'cryptodao-utils' @ 99.99.99 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-06-17T06:02:03.254409960Z","published":"2026-06-17T03:53:13Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-06-17T04:04:29Z","id":"IN-MAL-2026-006863","sha256":"97e08a5a6fa93f0080d53371f566846f4258ed5e50479f43b9fc10c7a9716410","versions":["99.99.99"],"source":"amazon-inspector","import_time":"2026-06-17T05:45:41.077244522Z"},{"modified_time":"2026-06-17T03:53:13Z","sha256":"fb6683ae60f6a98342ecd5399e61fbcbde57eebadc193eaa484d7adde2318bea","versions":["99.99.99"],"source":"ossf-package-analysis","import_time":"2026-06-17T05:45:38.882127481Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cryptodao-utils/v/99.99.99"}],"affected":[{"package":{"name":"cryptodao-utils","ecosystem":"npm","purl":"pkg:npm/cryptodao-utils"},"versions":["99.99.99"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-g/iUDwI+F1OE2bk2mNj53EP3FoLTiutYcbgfL72/8mLzE+tYR6onaaQW2mmuXT8uUYENPFvCIKqhRLcdjy1qbA==","sha1":"95cc390e3b4f39056aa6d4715b5c93abc917ba3b"},"filename":"cryptodao-utils-99.99.99.tgz"}],"evidence_files":[{"sha256":"3dd1f7827fe311d17f442e0af0fab46f3f1a938bb3409838536795fb1aa0f740","tlsh":"e481c9f046f1623815622784541f1012917bf297f2a6bbf4b6dc023a0faa96045f6fef","path":"recon.js"},{"sha256":"b45d3fd80997a873df55c6332c850ee0c247cdda0e13e8062cb5df9807279081","tlsh":"d5d0a7341d32bf2336cd1a976935980526f10d5e110496180387116852ed5f6b4ff219","path":"package.json"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cryptodao-utils/MAL-2026-5978.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}