Malicious pgserve npm Releases Harvest Credentials and Spread to Other Packages
Summary
StepSecurity reports that pgserve versions 1.1.11–1.1.13 added a credential-stealing postinstall script with npm and PyPI propagation. In a controlled run, it observed encrypted data exfiltration to an ICP canister; 1.1.10 was the last legitimate release.
Key points
- StepSecurity identifies pgserve versions 1.1.11, 1.1.12 and 1.1.13, published April 21, 2026, as compromised; it identifies 1.1.10 as the last legitimate release.
- The releases added scripts/check-env.js and scripts/public.pem and changed the package postinstall hook to run the script automatically.
- The script scans environment variables and developer files for credentials, including cloud, npm, SSH, wallet and browser-password data, then encrypts collected data with AES-256 and an RSA-4096 public key.
- StepSecurity says the malware can use discovered npm publish tokens to infect and publish modified packages, and PyPI tokens to spread through .pth file injection.
- In a controlled GitHub Actions run, StepSecurity observed 38 matching environment variables and successful encrypted exfiltration to cjn37-uyaaa-aaaac-qgnva-cai[.]raw[.]icp0[.]io; no npm token was found, so propagation did not occur in that run.
- Harden-Runner captured and blocked connections to the ICP canister and telemetry[.]api-monitor[.]com after the domains were added to its global block list.
- StepSecurity says it disclosed the issue to the maintainer and added the indicators to its block list.
Article Details
- Attack Vectors
- Compromised pgserve versions 1.1.11, 1.1.12, and 1.1.13 execute credential-harvesting code through an npm postinstall hook.
- The malware scans environment variables and developer credential files, including package-manager tokens, cloud credentials, SSH keys, crypto-wallet data, and Chrome saved passwords.
- If it finds an npm publish token, the malware modifies and publishes packages the victim can publish, adding its script and postinstall hook.
- If it finds a PyPI token, the malware spreads to Python packages using .pth file injection.
- Defensive Notes
- Avoid pgserve versions 1.1.11, 1.1.12, and 1.1.13; the article identifies 1.1.10 and earlier as safe.
- Block the reported exfiltration endpoints; the article says both were added to the Harden-Runner global block list.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//cjn37-uyaaa-aaaac-qgnva-cai[.]raw[.]icp0[.]io/drop | Reported primary exfiltration endpoint; the article says the malware sent encrypted credential data to this ICP canister. |
| URL | hxxps[:]//telemetry[.]api-monitor[.]com/v1/telemetry | Reported secondary webhook exfiltration endpoint, used when the TEL_SIGN_KEY environment variable is set. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware collects credential files, wallet data, browser password data, and other secrets from the developer's machine.T1027 · Obfuscated Files or InformationThe article's AI verdict describes the automatically executed malicious postinstall payload as heavily obfuscated.T1041 · Exfiltration Over C2 ChannelThe malware exfiltrates encrypted stolen data over network connections to the reported canister and webhook endpoints.T1059.006 · PythonThe article says a discovered PyPI token enables .pth file injection that executes when a Python interpreter runs.T1059.007 · JavaScriptThe malicious JavaScript runs through Node.js from the pgserve postinstall hook.T1195.002 · Compromise Software Supply ChainMalicious pgserve package versions were published to npm, and the malware attempts to propagate by modifying and publishing other packages.T1552.001 · Credentials In FilesThe malware searches environment variables and files such as ~/.npmrc, ~/.netrc, and cloud credential files for secrets and tokens.T1552.004 · Private KeysThe malware collects files under ~/.ssh/, including SSH keys.T1555.003 · Credentials from Web BrowsersThe malware copies Chrome's Login Data database and decrypts saved passwords.T1567.004 · Exfiltration Over WebhookThe malware can send stolen data to the secondary telemetry endpoint, which the article identifies as a webhook.
Vendors
Products
GitHub Actions/^COHERE/i, /^STRIPE/i, /^TWILIO_/i, /^SENDGRID_/i, ...];In our controlled analysis run on a GitHub Actions runner, the malware harvested 38 environment variables matching these patterns.npmOn April 21, 2026, malicious versions of pgserve were published to npm. pgserve is an embedded PostgreSQL server for development — zero config, auto-provisioned databases, designed to be dropped into any Node.jspgserveOn April 21, 2026, malicious versions of pgserve were published to npm. pgserve is an embedded PostgreSQL server for development — zero config, auto-provisioned databases, designed to be dropped into any Node.js
Tools
Harden Runneridentifying credential theft, env exfiltration, browser password theft, and network exfiltration; and Harden Runner, which captured the malware's exfil connections during a controlled analysis run.StepSecurity AI Package AnalystThis compromise was detected through two independent signals: the StepSecurity AI Package Analyst, which flagged all three compromised versions with a Critical / Rejected verdict, identifying credential theft, env