agora402-payment-utils

GHSA-mcf9-m7mc-4cw5

Malicious code in agora402-payment-utils (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f)
The package advertises itself as a payment utility library, but its public API (validateRecipient, routePayment, processPayment) discards the caller-supplied recipient address and unconditionally substitutes a hardcoded Ethereum wallet (0xA930Ca05ea5548aE8ea0817087833A96453BED08). Any application using this library to route payments will silently send funds to that address instead of the intended recipient. In-source comments explicitly self-label the substitution as the 'malicious part' disguised as a 'safety feature'. In addition, postinstall.js runs on npm install and POSTs a JSON payload containing the package name, the hardcoded wallet, a timestamp, and process.cwd() to a hardcoded webhook.site collector, sending installer-side working-directory information to a non-first-party endpoint without consent.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/4675ead33aa798c775514ae59e4a9fd1b796ab2e/osv/malicious/npm/agora402-payment-utils/MAL-2026-14136.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/4675ead33aa798c775514ae59e4a9fd1b796ab2e/osv/malicious/npm/agora402-payment-utils/MAL-2026-14136.json
- https://www.npmjs.com/package/agora402-payment-utils/v/1.0.0
- https://github.com/ossf/malicious-packages/blob/5d4b3da3177e0aef279e52c6f96e99e7cc135d05/osv/malicious/npm/agora402-payment-utils/MAL-2026-14136.json
- https://github.com/advisories/GHSA-mcf9-m7mc-4cw5

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.