@aerodrome-finance/slipstream

GHSA-p457-j9cc-cpmp

Malicious code in @aerodrome-finance/slipstream (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.1.0`

## Source: amazon-inspector (d9834357b7108ed122b3c272b3f913e0d2e931ab3629e94227b61f787fbe2525)
Package published as @aerodrome-finance/slipstream advertises 'Aerodrome Slipstream AMM contracts and ABIs' but ships only index.js, which is executed via preinstall and postinstall lifecycle hooks. On install, index.js enumerates process.env filtering keys matching a credential regex (KEY|TOKEN|SECRET|PASS|PRIVATE|MNEMONIC|AWS|GITHUB|NPM|WALLET|SEED|...), reads installer-side secret files including ~/.aws/credentials, ~/.ssh/id_rsa and id_ed25519, ~/.npmrc, ~/.netrc, ~/.docker, ~/.foundry/keystores, Solana/Sui key material, and.env files, serializes the collected data, and hands it off to a detached Node subprocess (spawn(process.execPath, ['-e', src], {detached:true, stdio:'ignore'}); ch.unref()) that sleeps 60-240 seconds before POSTing the JSON payload to https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09. The code also bails out when hostname/user match sandbox indicators (scan-, detonation, sandbox, ubuntu-fc-uvm, honey, canarytokens, npmmirror), evading install-time sandbox observation. The package name impersonates the Aerodrome Finance DeFi project and the harvest list targets crypto/DeFi developers (wallet keystores, RPC provider tokens, Foundry/Solana/Sui keys).

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/22de244ad7957d572fd65f650d9dd9fe2efddf21/osv/malicious/npm/@aerodrome-finance/slipstream/MAL-2026-13735.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/22de244ad7957d572fd65f650d9dd9fe2efddf21/osv/malicious/npm/@aerodrome-finance/slipstream/MAL-2026-13735.json
- https://www.npmjs.com/package/@aerodrome-finance/slipstream/v/1.0.0
- https://www.npmjs.com/package/@aerodrome-finance/slipstream/v/1.1.0
- https://www.npmjs.com/package/@aerodrome-finance/slipstream/v/1.1.1
- https://github.com/ossf/malicious-packages/blob/8b1ec19bee6eaef211ebd4375c98d15aead7cf1b/osv/malicious/npm/@aerodrome-finance/slipstream/MAL-2026-13735.json
- https://o3.security/blog/crypto-defi-npm-supply-chain-attack-npmrc-exfiltration
- https://www.npmjs.com/package/@aerodrome-finance/slipstream
- https://github.com/ossf/malicious-packages/blob/7d287226c4827ad7bbd142df678a71a6178b2386/osv/malicious/npm/@aerodrome-finance/slipstream/MAL-2026-13735.json

Compromised versions (1)

= 1.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.