create-coin

GHSA-468x-vgxv-xv9w

Malicious code in create-coin (npm)

Details

**Severity:** Critical

**Affected versions:** `= 20.1.1`

## Source: amazon-inspector (d92da1d80f455caae769107e4b3ff99c003a296f1238728cfc5521d5be06c380)
Package [email protected] registers a postinstall hook that runs build/payload.node.js during npm install. The script performs anti-analysis guards (bails out on CI/GitHub Actions env vars, /.dockerenv, container cgroups, or fewer than four environment variables), sleeps a randomized 10-30 seconds, then reads the installer's ~/.npmrc (or %USERPROFILE%\.npmrc), enumerates every process.env entry, and reads project files including package.json, package-lock.json,.env, and src/config.*. It also collects host reconnaissance via os.hostname(), os.userInfo(), and child_process output of uname/id, plus open localhost port probes. All collected data is POSTed over HTTPS to the hardcoded endpoint https://random-name.trycloudflare.com with rejectUnauthorized:false, and a.ran lock file is written for idempotency. Exceptions are swallowed and exit code is forced to 0 so npm install appears successful. The package.json description claims the package is a "netbsd-x64 build for esbuild" while the shipped code has no relationship to esbuild, indicating typosquat / platform-package impersonation of the esbuild family.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/51911d234a84078e05bdf54c4b86161625e68d64/osv/malicious/npm/create-coin/MAL-2026-14372.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/51911d234a84078e05bdf54c4b86161625e68d64/osv/malicious/npm/create-coin/MAL-2026-14372.json
- https://www.npmjs.com/package/create-coin/v/20.1.1
- https://github.com/ossf/malicious-packages/blob/4012598c9b06e58935bd8883f7a0cd37c3130664/osv/malicious/npm/create-coin/MAL-2026-14372.json
- https://github.com/ossf/malicious-packages/blob/78792aee23e5c759f309a3d2e9397caf2439773e/osv/malicious/npm/create-coin/MAL-2026-14372.json
- https://github.com/advisories/GHSA-468x-vgxv-xv9w

Compromised versions (1)

= 20.1.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.