Wiz Details npm Supply-Chain Attack Spreading Malicious Packages to 400+ Packages

Aug 4, 2026 · Original article ↗

Summary

Wiz says attackers used a compromised maintainer account to publish malicious npm packages that spread to more than 400 packages. The malware steals credentials and secrets, establishes persistence, and retrieves C2 domains from an Ethereum contract.

Key points

Attackers compromised a GitHub maintainer account, added IDE persistence payloads, and published malicious versions in the Keyv/Cacheable npm ecosystem.
Wiz reports the worm has propagated to more than 400 distinct npm packages; the article lists affected package versions and IOCs.
The payload is based on the Mini Shai-Hulud malware and targets cloud, developer, CI/CD, cryptocurrency, and AI-agent credentials and configuration.
It attempts persistence through Claude Code hooks and VS Code tasks, and exfiltrates data through GitHub repositories created under compromised identities.
The malware retrieves C2 domains from an Ethereum smart contract, allowing operators to change infrastructure without modifying the payload.
Wiz advises removing affected versions, rebuilding systems where packages were installed, rotating exposed credentials, reviewing environments for suspicious activity, and monitoring IOCs.

Article Details

Attack Vectors: A compromised GitHub maintainer account was used to introduce IDE persistence payloads to the keyv repository and publish malicious npm package versions.
The malicious package payload targets credentials, secrets, cryptocurrency wallets, and CI/CD environments for theft.
The payload attempts persistence through Claude Code hooks and VS Code tasks.json.
The malware exfiltrates data through GitHub repositories created under compromised identities.
The malware retrieves C2 domains from an Ethereum smart contract using eth_call.
Defensive Notes: Identify and remove affected package versions from development, build, and CI/CD environments.
Treat systems where malicious packages were installed as potentially compromised and rebuild them.
Rotate exposed credentials, including cloud credentials, GitHub tokens, SSH keys, Kubernetes configurations, Terraform credentials, and other developer secrets.
Review cloud and source-code environments for unauthorized access or suspicious activity after package installation.
Monitor the published indicators and strengthen software supply-chain defenses with dependency allowlisting, package integrity verification, and provenance controls.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`eth-mainnet[.]nodereal[.]io`	Listed as an Ethereum RPC endpoint associated with the malware's smart-contract C2-domain retrieval.
DOMAIN	`eth[.]llamarpc[.]com`	Listed as an Ethereum RPC endpoint associated with the malware's smart-contract C2-domain retrieval.
DOMAIN	`go[.]getblock[.]io`	Listed as an Ethereum RPC endpoint associated with the malware's smart-contract C2-domain retrieval.
DOMAIN	`js-mirror[.]com`	Listed in the article's IOC domain section as threat infrastructure.
DOMAIN	`npm-cache[.]com`	Identified as the exfiltration domain and the C2 domain returned by the smart contract.
DOMAIN	`pypi-get[.]com`	Listed in the article's IOC domain section as threat infrastructure.
IPV4	`104[.]21[.]35[.]216`	IP listed with the exfiltration domain npm-cache[.]com.
IPV4	`172[.]67[.]167[.]200`	IP listed with the Ethereum RPC endpoint eth.llamarpc[.]com.
IPV4	`185[.]44[.]207[.]215`	IP listed with the Ethereum RPC endpoint go.getblock[.]io.
IPV4	`35[.]175[.]164[.]77`	IP listed with the Ethereum RPC endpoint eth-mainnet.nodereal[.]io.
SHA1	`35a672cf34b996b91f3e1c28cbf3a05a37e036e4`	Hash listed for the malicious Math_Symbol.js and math_init.js file artifacts.
SHA1	`686aa40d0fc22c8d569494543a0f891f359f2f99`	Hash listed for the setup.mjs file artifact in .claude.
SHA1	`f525d52ceb966516686b482d3dc0137028cc6a63`	Hash listed for the setup.mjs file artifact in .vscode.