@aerodrome-finance/slipstream@1.0.0
Malicious code in @aerodrome-finance/slipstream (npm)
Analysis
The preinstall and postinstall hooks both run index.js, which harvests the installer's credentials and environment and exfiltrates them. It collects every environment variable whose name matches KEY/TOKEN/SECRET/PASS/PRIVATE/MNEMONIC/RPC/AWS/GITHUB/NPM/KUBE/VAULT/AUTH/PGP/GPG/SEED/WALLET, reads ~/.npmrc and ~/.gitconfig, and enumerates ~/.ssh, ~/.foundry/keystores (crypto wallet keystores), ~/.config/hardhat and ~/.config/gcloud. The collected data (hostname, username, cwd, platform, env values, npmrc/gitconfig contents, keystore listings) is POSTed as JSON to webhook[.]site/326b0891-2093-4800-a4c1-686ce3e07b09. The package name impersonates the Aerodrome Finance DeFi protocol.
- analyzed by
- Leitwacht
- first seen
- Aug 11, 2026, 06:08 AM
- analyzed
- Aug 11, 2026, 06:08 AM
Related advisories
- @aerodrome-finance/contracts@1.0.0
- camelot-ammv2-periphery@1.0.0
- boring-vault@1.0.0
- camelot-ammv2-core@1.0.0
- kit-vim-map@1.0.0
- @darshanpatel2608/cursor-dash@1.0.0
- simple-date-formatter-new-10@1.0.0
- cryptostock@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.