MAL-2026-13738

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@openzeppelin-5/contracts/MAL-2026-13738.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13738
Published
2026-08-11T15:16:36Z
Modified
2026-08-12T09:45:11Z
Summary
Malicious code in @openzeppelin-5/contracts (npm)
Details

@openzeppelin-5/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts (the v5 line) via the look-alike scope @openzeppelin-5, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — only an install-time payload (index.js) run via preinstall/postinstall that harvests credential-shaped environment variables and reads and exfiltrates SSH private keys, cloud credentials (AWS/GCP/Kubernetes/Docker), Solana/Anchor/NEAR/Sui wallet keys, Foundry keystores, .git-credentials and local .env files to https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09. It is one of a series of DeFi/crypto impersonation packages from the same account sharing this webhook.site endpoint, which also squat Aerodrome Finance, Camelot AMM, Euler EVC, BoringVault and Uniswap Permit2.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (800da818da3fee0353766227eafcd43c0c7cf7fd0126af5ded48b7c1ba522e21)

Package name typosquats @openzeppelin/contracts. package.json declares both preinstall and postinstall as node index.js || true, so the payload auto-executes on npm install. index.js harvests process.env entries matching KEY|TOKEN|SECRET|MNEMONIC|WALLET|AWS|GITHUB|NPM and reads installer-side credential files including ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.kube/config, ~/.docker/config.json, ~/.netrc, ~/.npmrc, ~/.git-credentials, gcloud/solana/sui/foundry keystores, and local.env files. The bundle is POSTed to a hardcoded webhook.site endpoint (path 326b0891-2093-4800-a4c1-686ce3e07b09) via a detached child process spawned with a randomized 60–240 second delay to outlive install-time scanning windows. A hostname regex (/^(scan-|detonation|sandbox|ubuntu-fc-uvm)/i) throws early on known sandbox/scanner hosts as anti-analysis gating.

Database specific 
{
    "iocs": {
        "urls": [
            "https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017360",
            "import_time": "2026-08-11T15:26:48.389466352Z",
            "modified_time": "2026-08-11T15:16:36Z",
            "sha256": "078ff524fafdb7c803081834abe8cf4678931b6f735fc695c8ef1ad339748e8f",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017362",
            "import_time": "2026-08-11T15:26:48.619801415Z",
            "modified_time": "2026-08-11T15:16:56Z",
            "sha256": "800da818da3fee0353766227eafcd43c0c7cf7fd0126af5ded48b7c1ba522e21",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @openzeppelin-5/contracts

Package

Name
@openzeppelin-5/contracts
View open source insights on deps.dev
Purl
pkg:npm/%40openzeppelin-5/contracts

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "7ecd1b4ed15e168b5ce7317ddd4b9cde6ffc513b9175269ff12a5eb64a4f7b85",
            "tlsh": "725163a322fa65982563e2d2e6576120623bf3827546f8c4f29c24144fce438c9f36fd"
        }
    ],
    "package_integrity": [
        {
            "filename": "contracts-1.0.0.tgz",
            "hashes": {
                "sha1": "b8de8e11950b86a5c24a3c77c388c0ffcc6d584a",
                "sha512_sri": "sha512-87+P/Ap128NGKlPLIdximS72WIRGOWlHq9lYiVm42muISamlpEJ+cdXtT4p0E4xcS0Gk/8v7lGRIiWi3BpxHSA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@openzeppelin-5/contracts/MAL-2026-13738.json"