MAL-2026-13940

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@opezneppelin/contracts/MAL-2026-13940.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13940
Published
2026-08-13T17:17:31Z
Modified
2026-08-13T17:30:11.184856810Z
Summary
Malicious code in @opezneppelin/contracts (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (abe04ec28ed56cb0a253131129df8078d425f8a0c579c439ced9c75b6977a6ab)

@opezneppelin/contracts is a typosquat of @openzeppelin/contracts. Its postinstall lifecycle script (scripts/postinstall.js) hex-escapes all module names, method names, and string constants (fs, https, child_process, powershell, -NoP,.exe) and stores the download URL as a base64 literal that decodes to https://files.catbox.moe/9bppy2.zip. On Windows installers, the script downloads that ZIP to %TEMP%, expands it via PowerShell Expand-Archive, recursively searches the extracted contents for the first.exe, and spawns it detached. The destination is an anonymous, mutable file-host (catbox.moe) unrelated to any OpenZeppelin infrastructure, and the fetched executable is opaque attacker-controlled content. The behavior fires automatically on npm install without any user action, resulting in arbitrary code execution on the installer's Windows host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017647",
            "import_time": "2026-08-13T17:24:45.875181164Z",
            "sha256": "abe04ec28ed56cb0a253131129df8078d425f8a0c579c439ced9c75b6977a6ab",
            "modified_time": "2026-08-13T17:17:31Z",
            "source": "amazon-inspector",
            "versions": [
                "5.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @opezneppelin/contracts

Package

Name
@opezneppelin/contracts
View open source insights on deps.dev
Purl
pkg:npm/%40opezneppelin/contracts

Affected ranges

Affected versions

5.*
5.0.2

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "scripts/postinstall.js",
            "tlsh": "cc41eed571d9632b23ec44e7f6245ee581a7dd12b1c9b043831c7a4e14d908acae6dc9",
            "sha256": "be0e358b5b4533c985c53d576f99a13ea680a03cda0d0885c50d062e540a043c"
        }
    ],
    "package_integrity": [
        {
            "filename": "contracts-5.0.2.tgz",
            "hashes": {
                "sha1": "4b518ff7f9bf8c5e8fbbadf5413b9d2891411145",
                "sha512_sri": "sha512-Dj5/ri6BPZ2ZHeI2npsZalMnmZOzdytcK0/XEDf+C4Ci0lIK+PXQIEY/gy+8eaj2SNQZYdXFAjDTgIt8HPW+wg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@opezneppelin/contracts/MAL-2026-13940.json"