cryptodao-utils

{"modified":"2026-06-17T05:47:34Z","published":"2026-06-17T03:53:13Z","schema_version":"1.7.4","id":"MAL-2026-5978","summary":"Malicious code in cryptodao-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (97e08a5a6fa93f0080d53371f566846f4258ed5e50479f43b9fc10c7a9716410)\npackage.json declares `postinstall: node recon.js`, which runs automatically on every `npm install`. recon.js harvests host information and a curated list of credential-bearing environment variables (AWS_SECRET_ACCESS_KEY, NPM_TOKEN, GITLAB_ACCESS_TOKEN, CI_JOB_TOKEN, SSH_PRIVATE_KEY, DB_PASSWORD, PRIVATE_KEY, MNEMONIC, SEED_PHRASE, DOCKER_PASSWORD, and others), grep-reads.env files at common installer paths for KEY/SECRET/TOKEN/PASS/PRIVATE/MNEMONIC lines, and POSTs the collected bundle to two attacker-controlled endpoints: `https://webhook.site/d6d18927-e513-4df7-b019-58bfc64fe0dd` and `https://enqoojbegdvxj.x.pipedream.net/`. The HTTPS requests are issued with `rejectUnauthorized: false`, disabling certificate validation so exfiltration succeeds through TLS-intercepting proxies. The package self-identifies in source comments as a 'CryptoDAO Dependency Confusion Reconnaissance Payload' and is published at version 99.99.99 — the canonical shape used to outrank an internal `cryptodao-utils` package during registry resolution. Combined, this is a complete dependency-confusion credential-harvest attack against any installer whose build pipeline resolves the public name.\n\n## Source: ossf-package-analysis (fb6683ae60f6a98342ecd5399e61fbcbde57eebadc193eaa484d7adde2318bea)\nThe OpenSSF Package Analysis project identified 'cryptodao-utils' @ 99.99.99 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"ecosystem":"npm","name":"cryptodao-utils"},"versions":["99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"recon.js","sha256":"3dd1f7827fe311d17f442e0af0fab46f3f1a938bb3409838536795fb1aa0f740","tlsh":"e481c9f046f1623815622784541f1012917bf297f2a6bbf4b6dc023a0faa96045f6fef"},{"path":"package.json","sha256":"b45d3fd80997a873df55c6332c850ee0c247cdda0e13e8062cb5df9807279081","tlsh":"d5d0a7341d32bf2336cd1a976935980526f10d5e110496180387116852ed5f6b4ff219"}],"package_integrity":[{"filename":"cryptodao-utils-99.99.99.tgz","hashes":{"sha1":"95cc390e3b4f39056aa6d4715b5c93abc917ba3b","sha512_sri":"sha512-g/iUDwI+F1OE2bk2mNj53EP3FoLTiutYcbgfL72/8mLzE+tYR6onaaQW2mmuXT8uUYENPFvCIKqhRLcdjy1qbA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cryptodao-utils/v/99.99.99"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-006863","import_time":"2026-06-17T05:45:41.077244522Z","modified_time":"2026-06-17T04:04:29Z","sha256":"97e08a5a6fa93f0080d53371f566846f4258ed5e50479f43b9fc10c7a9716410","source":"amazon-inspector","versions":["99.99.99"]},{"import_time":"2026-06-17T05:45:38.882127481Z","modified_time":"2026-06-17T03:53:13Z","sha256":"fb6683ae60f6a98342ecd5399e61fbcbde57eebadc193eaa484d7adde2318bea","source":"ossf-package-analysis","versions":["99.99.99"]}]}}