cryptodao-contracts

{"modified":"2026-06-17T04:04:31Z","published":"2026-06-17T04:04:31Z","schema_version":"1.7.4","id":"MAL-2026-5975","summary":"Malicious code in cryptodao-contracts (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (21c450a1d14c10213b83137f9c0670a9d8ed953105f96d66eedee78a56479d82)\nPackage is published as version 99.99.99 to win private-vs-public resolution against an internal `cryptodao-contracts` namespace. The package's main module is a one-line stub; the real payload runs from the postinstall script `recon.js`. On `npm install`, recon.js enumerates a hardcoded list of installer-side secret environment variables (AWS_SECRET_ACCESS_KEY, SSH_PRIVATE_KEY, NPM_TOKEN, GITLAB_ACCESS_TOKEN, MNEMONIC, SEED_PHRASE, PRIVATE_KEY, DB_PASSWORD, etc.), reads `.env` files from installer-owned paths (`/root/.env`, `/app/.env`, `.env.production`), and grep-extracts lines matching KEY|SECRET|TOKEN|PASS|PRIVATE|MNEMONIC. The collected secrets, hostname, user, cwd, and CI build-directory listings are POSTed over HTTPS to two attacker-controlled endpoints, `webhook.site/d6d18927-e513-4df7-b019-58bfc64fe0dd` and `enqoojbegdvxj.x.pipedream.net`, with TLS verification disabled (`rejectUnauthorized: false`). Self-described in source as a 'CryptoDAO Dependency Confusion Reconnaissance Payload'.\n","affected":[{"package":{"ecosystem":"npm","name":"cryptodao-contracts"},"versions":["99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"recon.js","sha256":"3dd1f7827fe311d17f442e0af0fab46f3f1a938bb3409838536795fb1aa0f740","tlsh":"e481c9f046f1623815622784541f1012917bf297f2a6bbf4b6dc023a0faa96045f6fef"},{"path":"package.json","sha256":"c6efdcef6c3731ec4440dda561911e831181435169eb5fe5d4f41335cd7f1d9a","tlsh":"60d0a7352d72fb3336cd1ba76835d40526b15e5e5104960903c7216941ed1f664ff359"}],"package_integrity":[{"filename":"cryptodao-contracts-99.99.99.tgz","hashes":{"sha1":"df322dcf49638288a3fcfb1f2631145d7d27710c","sha512_sri":"sha512-fJNlzicPayxBTnOhWgJaN5S9h+yhbyj4eY4Dg49sozudHXZeB+TvHkb3L43kEndPRl6nKiKSt9TQdsx+PoP7FA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cryptodao-contracts/v/99.99.99"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-006867","import_time":"2026-06-17T05:45:41.242143797Z","modified_time":"2026-06-17T04:04:31Z","sha256":"21c450a1d14c10213b83137f9c0670a9d8ed953105f96d66eedee78a56479d82","source":"amazon-inspector","versions":["99.99.99"]}]}}