@openzeppelin-4/contracts@1.0.0
Malicious code in @openzeppelin-4/contracts (npm)
Analysis
Combosquat of the OpenZeppelin contracts library. The preinstall and postinstall hooks both run index.js, which harvests environment variables whose names match KEY/TOKEN/SECRET/PASS/PRIVATE/MNEMONIC/WALLET/AWS/GITHUB/NPM/etc., reads credential and wallet files from the home directory (~/.aws/credentials, ~/.ssh/id_rsa, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.git-credentials, Solana/Anchor/Sui/Foundry keystores, gcloud credentials) and .env files in the working directory, then POSTs the collected data as JSON to hxxps://webhook[.]site/326b0891-2093-4800-a4c1-686ce3e07b09 over TLS. The hook swallows all errors so installs never fail.
- analyzed by
- Leitwacht
- first seen
- Aug 11, 2026, 09:09 AM
- analyzed
- Aug 11, 2026, 09:10 AM
Related advisories
- permit2@1.0.0
- ethereum-vault-connector@1.0.0
- boring-vault@1.0.0
- camelot-ammv2-core@1.0.0
- move-bcs-codec@1.0.0
- python-bitcoinlib@1.0.2
- simple-date-formatter-new-6@1.0.0
- simple-date-formatter-new-3@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.