Malicious Code in Velora SDK 9.4.1 Downloads and Runs a Remote Shell Script
Summary
An analysis found that @velora-dex/sdk 9.4.1 runs an obfuscated payload on import, downloading and executing a shell script from 89.36.224.5. The article says versions 9.4.2 and later are clean.
Key points
- The analysis found malicious code in dist/index.js of @velora-dex/sdk version 9.4.1; the examined development builds and other listed versions were clean.
- On package import, the code decodes a base64-encoded command and uses curl to download and run a shell script from http://89.36.224.5/troubleshoot/mac/install.sh.
- The article says execution occurs in a background process and with the privileges of the Node.js process.
- The report identifies possible risks including theft of cryptocurrency wallets or private keys, credential and environment-variable harvesting, and backdoor installation; it does not establish that these outcomes occurred.
- The author suspects compromise of the build or release pipeline, based on clean development versions and the malicious published release; the specific attack vector is not confirmed.
- The article identifies version 9.4.2 as a clean remediation release and reports that version 9.4.1 was removed from npm in a July 13, 2026 update.
- Recommended response includes removing version 9.4.1, checking for connections to the listed IP, reviewing affected systems and build artifacts, and rotating potentially exposed credentials.
Article Details
- Attack Vectors
- The article reports that version 9.4.1 of the @velora-dex/sdk package was compromised during the build or release process and published to the npm registry; it hypothesizes a build-pipeline compromise rather than a source-repository breach.
- On package import, the modified dist/index.js automatically runs a base64-obfuscated command through Node.js child_process.exec(), decodes it, and uses bash to download and execute a remote shell script.
- The script download runs in the background using nohup, with output redirected to /dev/null.
- Defensive Notes
- Remove version 9.4.1 and update to version 9.4.2 or later; check installed dependencies, lock files, and build artifacts for the compromised version.
- If version 9.4.1 was installed or used in CI/CD, isolate affected systems, review outbound connections and running processes, investigate persistence and lateral movement, and rotate credentials, API keys, and CI/CD secrets.
- Pin dependency versions, verify package integrity, review lock-file changes, monitor outbound network connections, and use least privilege for Node.js processes and build environments.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 89[.]36[.]224[.]5 | C2 server IP used to host the shell script downloaded by the compromised package. |
| URL | hxxp[:]//89[.]36[.]224[.]5/troubleshoot/mac/install.sh | Malicious payload URL used by the package to download a shell script for execution. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe package entry point contains a base64-obfuscated command that is decoded before execution.T1059.004 · Unix ShellThe decoded command invokes bash to download and execute the remote shell script.T1105 · Ingress Tool TransferThe command uses curl to download the shell script from the reported C2 server.T1195.002 · Compromise Software Supply ChainThe article reports that malicious code was introduced into the @velora-dex/sdk 9.4.1 build or release and distributed through the npm registry.