verdaccio-okta-oauth@38.1.12
Malicious code in verdaccio-okta-oauth (npm)
Analysis
The package is a trojanized clone of the verdaccio-okta-oauth plugin. On npm install, the preinstall hook (setup.mjs) downloads the Bun JavaScript runtime binary from github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/ (selecting the correct binary for the platform/architecture), extracts it, and executes a 727KB heavily-obfuscated file (math_init.js) through it. The obfuscated payload uses eval, Function constructor, and child_process calls. The legitimate plugin source code is included as cover but the install-time execution of the downloaded runtime and obfuscated payload is the attack vector.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 11:29 AM
- analyzed
- Aug 4, 2026, 11:46 AM
- weekly installs
- 238
Related advisories
- @servicetitan/carto-react-kit@0.8.8
- verdaccio-tarball-local-storage@38.1.12
- @servicetitan/json-render-react@0.4.10
- @servicetitan/marketing-direct-mail-components@20.1.5
- folder-lint@1.0.17
- editable-contracts@0.0.23
- @servicetitan/anvil2-ext-charts@0.2.8
- @servicetitan/carto-rn-kit@0.0.14
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.