@wizloft/harness-context

GHSA-4pph-8v8q-67x2

Malicious code in @wizloft/harness-context (npm)

Details

**Severity:** Critical

**Affected versions:** `= 0.1.1-alpha.3`

## Source: amazon-inspector (b0315deb3fb6b42e929a55eafaeaedbf1b428ee8873d4ae31f5ec9956f21b554)
dist/index.js (the package's declared main) contains a heavily obfuscated obfuscator.io-style IIFE appended after the legitimate context-service code. On import, the payload stashes `global.r = require` and `global.m = module`, then issues HTTPS requests to an Ethereum public RPC endpoint (h.drpc.org) and a block-explorer account API to read state from contract 0xa322E5f3..., using that state to resolve a next-stage URL that is fetched and executed in-process. The obfuscated string array (~303 entries via a rotated decoder) hides `drpc.org`, `?module=ac`, `POST`, `application/json`, `Mozilla/5.`, and the contract address. This is the EtherHiding loader pattern: attacker-controlled contract state serves as a mutable pointer to arbitrary code executed in the installer/consumer process at require time. Behavior does not match the package's advertised purpose of a small typed capability contract.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/212ab477a3bdce7d9f5412f6647f735d6aecceb6/osv/malicious/npm/@wizloft/harness-context/MAL-2026-14286.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/212ab477a3bdce7d9f5412f6647f735d6aecceb6/osv/malicious/npm/@wizloft/harness-context/MAL-2026-14286.json
- https://www.npmjs.com/package/@wizloft/harness-context/v/0.1.1-alpha.3
- https://github.com/advisories/GHSA-4pph-8v8q-67x2

Compromised versions (1)

= 0.1.1-alpha.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.