npm: 14 Malicious 'Zentra Finance' Packages Dropped in Coordinated One-Minute Burst
On 2026-05-18, 14 malicious npm packages impersonating the Zentra Finance ecosystem were disclosed within a single minute, all sharing a coordinated naming theme and all published just 13 days prior to the advisories.
Key findings
- All 14 malicious packages were disclosed within the same minute on 2026-05-18
- Every package impersonates the Zentra Finance DeFi ecosystem via scope names and typosquats
- All packages were first published on the same day as the advisories — just hours before being flagged
- Every GHSA advisory carries a Critical severity rating
- Download counts remain low (under 2,000 total), suggesting early detection
- The campaign targets blockchain and Web3 developers, a high-value demographic for credential theft
Coordinated Typosquat Campaign Targets Zentra Finance Ecosystem
On 2026-05-18, security researchers disclosed 14 malicious npm packages in a tightly coordinated burst — every advisory was published within the same minute at 14:14 UTC. The packages all impersonate the legitimate Zentra Finance decentralized finance (DeFi) protocol, a project that provides smart-contract tooling and SDKs for blockchain applications.
The campaign signature is unmistakable: every package name either begins with the @zentrafinance/ npm scope, includes "zentra" or "citrea" as a prefix, or is a direct typosquat of known Zentra Finance module names. Representative examples include:
@zentrafinance/contracts@zentrafinance/protocol-config@zentrafinance/types@zentrafinance/sdkcitrea-bridgecitrea-sdkcitrea-utilsclementine-sdkzentra-financezentra-sdk
All 14 packages were first published on 2026-05-18 — the same day the advisories were issued — meaning they were registered and uploaded to the npm registry just hours before being flagged. None of the packages had accumulated significant download counts (most show between 21 and 37 weekly downloads, with lifetime totals under 2,000), suggesting the campaign was caught early before widespread adoption.
Malicious Behavior
OpenSSF Package Analysis findings on these packages reveal consistent malicious behavior. The packages execute post-install scripts that communicate with remote hosts, exfiltrate environment variables, and deploy credential-harvesting routines. The behavioral profile matches a supply-chain attack aimed at developers working with blockchain and DeFi tooling — a high-value target given the financial assets often managed through such libraries.
Every GHSA advisory for these packages carries a Critical severity rating. The standard advisory language warns that any computer which installed these packages should be considered fully compromised, and all secrets, API keys, and cryptographic tokens stored on that machine must be rotated from a separate, trusted system.
Severity and Risk
The coordinated nature of the disclosure — all 14 advisories landing in the same minute — indicates a single takedown action by the npm security team or a security researcher who identified the entire campaign at once. The fact that all packages were published on the same day they were disclosed suggests the attacker registered them in bulk, likely via automated tooling, and may have been preparing to distribute them through social engineering or dependency confusion attacks targeting Zentra Finance users.
While the download numbers are low, the risk profile is elevated because the packages impersonate a specific, real DeFi project. Developers searching for @zentrafinance/sdk or citrea-bridge on npm could easily mistake the malicious versions for the legitimate packages, especially if the attacker had published additional versions or promoted them through fake documentation.
Detection and Response
Developers who work with Zentra Finance or related blockchain tooling should immediately audit their package-lock.json, yarn.lock, or pnpm-lock.yaml files for any of the following package names:
@zentrafinance/contracts @zentrafinance/protocol-config @zentrafinance/types @zentrafinance/sdk citrea-bridge citrea-sdk citrea-utils clementine-sdk zentra-finance zentra-sdk
If any of these packages are found in a project's dependency tree, the affected machine should be treated as compromised. All credentials, API tokens, and private keys should be rotated from a clean machine. Developers should also check npm access logs for any unauthorized publishes associated with their accounts.
Broader Context
This campaign follows an increasing trend of supply-chain attackers targeting the Web3 and DeFi developer ecosystem. By impersonating well-known blockchain infrastructure packages, attackers aim to slip malicious code into CI/CD pipelines where it can exfiltrate wallet keys, smart-contract deployment credentials, and private repository access tokens. The tight coordination — 14 packages in under a minute — mirrors the operational tempo of automated typosquatting and dependency-confusion campaigns seen across npm, PyPI, and other registries in recent months. The Zentra Finance impersonation campaign is a reminder that even niche, recently-published packages can be weaponized against developers who trust ecosystem naming conventions.