@wizloft/harness-context

{"modified":"2026-08-19T08:33:13Z","published":"2026-08-19T08:33:13Z","schema_version":"1.7.4","id":"MAL-2026-14286","summary":"Malicious code in @wizloft/harness-context (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b0315deb3fb6b42e929a55eafaeaedbf1b428ee8873d4ae31f5ec9956f21b554)\ndist/index.js (the package's declared main) contains a heavily obfuscated obfuscator.io-style IIFE appended after the legitimate context-service code. On import, the payload stashes `global.r = require` and `global.m = module`, then issues HTTPS requests to an Ethereum public RPC endpoint (h.drpc.org) and a block-explorer account API to read state from contract 0xa322E5f3..., using that state to resolve a next-stage URL that is fetched and executed in-process. The obfuscated string array (~303 entries via a rotated decoder) hides `drpc.org`, `?module=ac`, `POST`, `application/json`, `Mozilla/5.`, and the contract address. This is the EtherHiding loader pattern: attacker-controlled contract state serves as a mutable pointer to arbitrary code executed in the installer/consumer process at require time. Behavior does not match the package's advertised purpose of a small typed capability contract.\n","affected":[{"package":{"ecosystem":"npm","name":"@wizloft/harness-context"},"versions":["0.1.1-alpha.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"d414e0737a498fe710e7ffb224de0ed14cf847bfc42b18529ca10d4e118882b9","tlsh":"64f294c4bbd0a44003076abb7b1bf4e5e56a08adb4844ac6f11cfe84fb96326d5f2531"}],"package_integrity":[{"filename":"harness-context-0.1.1-alpha.3.tgz","hashes":{"sha1":"621a5786ea5e82611571caaebbbc0c45233746a7","sha512_sri":"sha512-QuJ0Zc/EozGNeGCAhDuryXKfykj8OtD6FrDttkKJiadHdjcl1uGKBXDFSVlpnEdLV+ZoIS8gm9N7buLA28FwGg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wizloft/harness-context/v/0.1.1-alpha.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018408","import_time":"2026-08-19T08:48:53.666015613Z","modified_time":"2026-08-19T08:33:13Z","sha256":"b0315deb3fb6b42e929a55eafaeaedbf1b428ee8873d4ae31f5ec9956f21b554","source":"amazon-inspector","versions":["0.1.1-alpha.3"]}]}}