LWA-2026-10951 confirmed malware
@aerodrome-finance/contracts@1.0.0
Malicious code in @aerodrome-finance/contracts (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1552.001 · Credentials In FilesT1005 · Data from Local SystemT1041 · Exfiltration Over C2 Channel
Analysis
The preinstall and postinstall hooks both run index.js, which harvests the installer's environment variables whose names match KEY/TOKEN/SECRET/PASS/PRIVATE/MNEMONIC/RPC/AWS/GITHUB/NPM/KUBE/VAULT/AUTH/PGP/GPG/SEED/WALLET, reads ~/.npmrc and ~/.gitconfig, and lists the contents of ~/.ssh, ~/.foundry/keystores, ~/.config/hardhat, and ~/.config/gcloud. It then POSTs all of this data as JSON to hxxps://webhook[.]site/326b0891-2093-4800-a4c1-686ce3e07b09. The package name impersonates the Aerodrome Finance protocol contracts package.
- analyzed by
- Leitwacht
- first seen
- Aug 11, 2026, 06:08 AM
- analyzed
- Aug 11, 2026, 06:08 AM
Related advisories
- @aerodrome-finance/slipstream@1.0.0
- global-intel@1.0.1
- @fedfub/string-utils@1.0.0
- dojo-rn-interview@1.0.1
- move-bcs-codec@1.0.0
- streak-map-cache@1.0.0
- app-hsu-layer@2.1.6
- ethers-lib@1.0.3
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.