Neutralinojs Repositories Hit in Supply-Chain Attack Deploying BeaverTail Malware
Summary
Researchers report four Neutralinojs repositories were compromised through force-pushed, backdated commits that injected obfuscated BeaverTail malware. They describe blockchain-based C2, say npm packages were unaffected, and report cleanup and detection steps.
Key points
- OpenSourceMalware says a likely compromised contributor account force-pushed malicious commits to four Neutralinojs repositories in a 132-second window on March 2, 2026; commit dates were backdated and authorship spoofed.
- Payloads were hidden after long runs of whitespace in JavaScript files, with `.gitignore` changes helping conceal environment files and tooling.
- The investigation describes a multi-stage JavaScript payload that retrieves encrypted commands through Tron, Aptos, and Binance Smart Chain transactions before deploying BeaverTail.
- Reported capabilities include theft of credentials and system data, persistence in application dependencies, and remote execution; the researchers attribute the activity to a DPRK-linked campaign.
- The researchers say the npm packages were not compromised, but users who cloned affected repositories may have obtained malicious code.
- OpenSourceMalware and maintainers removed malicious code, and Vercel removed two reported C2 endpoints. Users who executed the payload are advised to treat their systems as compromised and rotate accessible credentials.
- The researchers report finding the same obfuscation family in more than 106 GitHub repositories and provide search strings and file-size checks for detection.
Article Details
- Attack Vectors
- A compromised GitHub account with organization-level write access force-pushed malicious commits across four Neutralinojs repositories.
- The attacker amended existing commits, spoofed commit authorship, and backdated timestamps to disguise malicious changes as routine project history.
- Obfuscated JavaScript payloads were appended after extensive whitespace in source and configuration files, including a CI test runner.
- The compromised repositories exposed developers who cloned or built from source to the payloads; the article reports that the NPM packages themselves were not compromised.
- Defensive Notes
- Check Neutralinojs repository clones made since March 2, 2026 for the string rmcej%otb%.
- Treat a system as fully compromised if the payload was executed there; rotate credentials, tokens, and SSH keys accessible from that system.
- Review repository history and server-side GitHub Actions triggering_actor fields and event timestamps rather than relying on commit author and committer dates.
- Inspect JavaScript files for unexpected payloads appended after long whitespace, and investigate suspicious configuration-file size increases.
- The article says the malicious code was removed from the origin repositories and the reported NPM packages were not compromised.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | auth-rho-dun[.]vercel[.]app | Attacker-used Vercel-hosted C2 domain for a payload-serving endpoint. |
| DOMAIN | data-kappa[.]vercel[.]app | Attacker-used Vercel-hosted C2 domain for a payload-serving endpoint. |
| SHA256 | 11e87f7f27b3cf1a51e0b4b3903decd8945b5959eedf3cbc6be1920dab3c8823 | SHA-256 hash of the Stage 3 payload used to configure C2 and fetch the final payload. |
| SHA256 | 904afe0337fbbd79def403b3204f75b4c5fbe4e2271252d22c0307f9cbd14646 | SHA-256 hash of the Stage 1 C2-served payload variant associated with data-kappa. |
| SHA256 | a507b74b6b1e25444c586bc67ae0244cba3037f2b39f25f7eb507ded97c373c1 | SHA-256 hash of the C2 payload associated with auth-rho-dun. |
| SHA256 | d4e269df0f50998c7ebf2bf56945d3d615fd6516702b1da8ac030ffcba735263 | SHA-256 hash of the final BeaverTail payload. |
| URL | hxxps[:]//auth-rho-dun[.]vercel[.]app/api | Vercel-hosted C2 endpoint reported as serving an obfuscated JavaScript payload. |
| URL | hxxps[:]//data-kappa[.]vercel[.]app/ | Vercel-hosted C2 endpoint reported as actively serving an obfuscated payload. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe JavaScript payloads used multiple obfuscation layers, encrypted strings, and whitespace padding to conceal injected code.T1041 · Exfiltration Over C2 ChannelThe malware reportedly uploads source code, credentials, and system information to attacker infrastructure.T1056.001 · KeyloggingBeaverTail is reported to steal authentication credentials and tokens, including Discord tokens, GitHub credentials, NPM tokens, SSH keys, and cryptocurrency wallet data.T1059.007 · JavaScriptObfuscated JavaScript payloads were injected into repository files and executed in the Node environment.T1071.001 · Web ProtocolsThe malware establishes WebSocket-based command and control over HTTPS on port 443.T1078 · Valid AccountsThe attacker used a compromised GitHub account with write access to force-push malicious commits.T1102 · Web ServiceThe malware retrieves encrypted payload data from blockchain transactions, using Tron, Aptos, and Binance Smart Chain as part of its command-and-control architecture.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious commits were force-pushed into upstream open-source project repositories, exposing downstream users who cloned or built from source.T1547 · Boot or Logon Autostart ExecutionThe article reports that BeaverTail establishes persistence by injecting code into node_modules and modifying application startup files.T1574.001 · DLLThe final payload reportedly injects malicious code into node_modules and modifies application startup files such as main.js and index.js.
People
Threat Actors
DPRKOpenSourceMalware attributed the repository compromise and broader campaign to DPRK, citing links to earlier incidents and BeaverTail.Lazarus GroupNamed by the article in parentheses alongside BeaverTail as the DPRK-associated group.Polin9912The article says a subsequent report will analyze the broader campaign and its attribution to a DPRK-linked threat actor operating under this GitHub handle.
Malware
Vendors
Products
CursorCursor Editor - Infects application resourcesDiscordDiscord - Steals authentication tokens and user dataGitHubcross-platform desktop applications using JavaScript, HTML and CSS. The project has 8400 stars on GitHub, 488 forks and dozens of contributers. The OSM team immediately removed the malicious code with a GitHubNeutralinojsThe OpenSourceMalware team has identified a new attack on the popular development framework Neutralinojs. Neutralinojs is a platform that lets developers build lightweight cross-platform desktop applications usingnpmWere the Neutralinojs NPM packages affected?VSCodeVSCode - Compromises extensions (especially @vscode/deviceid)