MAL-2026-4396

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@izumiswap/sdk/MAL-2026-4396.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4396
Aliases
  • GHSA-q782-j24w-vv68
Published
2026-05-25T20:18:07Z
Modified
2026-05-26T13:47:10.628825614Z
Summary
Malicious code in @izumiswap/sdk (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (63bd0a7aaa4ac18d8ae0c57c07bec05cb4f69e8650e77c117d11c048e5cec004)

On npm install, scripts/postinstall.js runs as the preinstall/postinstall lifecycle hook and performs an unambiguous install-time RCE. It first collects installer-identifying metadata (process.platform, os.arch(), os.hostname(), os.userInfo().username, process.version, process.cwd()), base64-encodes it, and sends it as a query parameter to a hardcoded bare IP over plain HTTP (http://213.218.160.189:8080/s?q=<base64>). The destination URL is obfuscated via char-code array decoding ([104,116,116,112,58,...].map(c=>String.fromCharCode(c)).join('')) to evade static review. The HTTP response body is written to a file under the npm cache directory (~/.npm-cache/v-<ts>.js) and executed with spawn(process.execPath, [_f], { detached: true }), then deleted 60 seconds later to remove forensic evidence. The destination IP has no relationship to the package's claimed izumi.finance publisher; there is no TLS, no integrity check, and no version pinning. The package name @izumiswap/sdk also impersonates the legitimate iZiSwap SDK (iziswap-sdk from izumiFinance), targeting developers searching for the real SDK. Any installer running npm install @izumiswap/sdk executes attacker-controlled JavaScript with the full environment of the installing user.

Source: ghsa-malware (bfe6dfe841c1d0cc615a5d93d813cb3a64edb47075ab36a65186d90a71281eb6)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-05-26T05:53:15.031333616Z",
            "versions": [
                "3.0.4"
            ],
            "sha256": "63bd0a7aaa4ac18d8ae0c57c07bec05cb4f69e8650e77c117d11c048e5cec004",
            "id": "IN-MAL-2026-004771",
            "source": "amazon-inspector",
            "modified_time": "2026-05-25T20:18:07Z"
        },
        {
            "modified_time": "2026-05-25T20:18:11Z",
            "versions": [
                "3.0.3"
            ],
            "sha256": "7d47c4739211fadbeeda6e310827742586324cc0aa0ca9fec63eab52ea3cd793",
            "id": "IN-MAL-2026-004772",
            "source": "amazon-inspector",
            "import_time": "2026-05-26T05:53:15.178804556Z"
        },
        {
            "modified_time": "2026-05-25T20:24:58Z",
            "versions": [
                "3.0.5"
            ],
            "sha256": "9484a372eef8fa7640d1b3d6cf298366ff5306a46aea3526a8c5f9af1df523c5",
            "id": "IN-MAL-2026-004773",
            "source": "amazon-inspector",
            "import_time": "2026-05-26T05:53:15.288781348Z"
        },
        {
            "modified_time": "2026-05-26T12:15:43Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "bfe6dfe841c1d0cc615a5d93d813cb3a64edb47075ab36a65186d90a71281eb6",
            "id": "GHSA-q782-j24w-vv68",
            "source": "ghsa-malware",
            "import_time": "2026-05-26T13:21:46.735762158Z"
        },
        {
            "import_time": "2026-05-26T13:32:46.223027348Z",
            "versions": [
                "3.0.6"
            ],
            "sha256": "7c5c64e8ef10bc0dd5e58da79a51baba0cdc5fb426f4e7e786fe4e0988777504",
            "id": "IN-MAL-2026-004900",
            "source": "amazon-inspector",
            "modified_time": "2026-05-26T10:47:44Z"
        }
    ]
}
References
Credits

Affected packages

npm / @izumiswap/sdk

Package

Name
@izumiswap/sdk
View open source insights on deps.dev
Purl
pkg:npm/%40izumiswap%2Fsdk

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.0.3
3.0.4
3.0.5
3.0.6

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "bc60a2e94291d19104f91a6a87ff58461b97ddf57626ce3cc6fc7b3641f3d157",
            "tlsh": "a62161d243e3173821b282c562aa80075257d61333c0e1f4f6ac82897f8926495b24ee",
            "path": "scripts/postinstall.js"
        },
        {
            "sha256": "f43ac4bec5ffe9479d7e3b33cc80b2a550d19a24978fcbe5a94b8ccf0c8a7b6f",
            "tlsh": "bc012566c8749e632fe473814ca55503a2518c8bcd60781c23d3012d8bde6ab91fe62e",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-6KPInKPYwyyZ78y0I2oTx5En/tADc6cDFIz5Tvu0OouJmAEuVZhtSsI38zLZy4qbeHUm/KEAJeu58BI6zlJqVg==",
                "sha1": "72ed9d3c5944f52fcde4fface09c1ea78442fc64"
            },
            "filename": "sdk-3.0.4.tgz"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@izumiswap/sdk/MAL-2026-4396.json"