@aerodrome-finance/contracts

GHSA-wj9v-gmm3-32pv

Malicious code in @aerodrome-finance/contracts (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.1.0`

## Source: amazon-inspector (2c46806c21e6a0f5a5593eca11bbd822991f566dc05eb50c7ec56f88b649c3be)
Package name typosquats the legitimate @aerodrome-finance scope. Lifecycle hooks auto-execute index.js on npm install, which reads installer secrets from ~/.aws/, ~/.ssh/, ~/.kube/, ~/.docker/, ~/.netrc, ~/.npmrc, ~/.pypirc, ~/.git-credentials, gcloud/solana/anchor/sui key directories, Foundry keystores, and.env files, and scrapes process.env for keys matching KEY|TOKEN|SECRET|PASS|PRIVATE|MNEMONIC|AWS|GITHUB|NPM|WALLET|SEED. The collected data is POSTed to a hardcoded webhook.site endpoint via https.request from a detached child process (spawn(process.execPath, ['-e', src], {detached:true, stdio:'ignore'})) that sleeps 60-240 seconds before sending, to outlive install and scan windows. Sandbox/honeypot evasion is present: host regex checks for scan-/detonation/sandbox/ubuntu-fc-uvm prefixes, non-root/sandbox user checks, canarytoken/honey env checks, and a check for npm mirror registries. Static evidence confirms co-use of child_process, https, os, and fs, with os.hostname() and a POST to https.request in index.js.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/22de244ad7957d572fd65f650d9dd9fe2efddf21/osv/malicious/npm/@aerodrome-finance/contracts/MAL-2026-13734.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/22de244ad7957d572fd65f650d9dd9fe2efddf21/osv/malicious/npm/@aerodrome-finance/contracts/MAL-2026-13734.json
- https://www.npmjs.com/package/@aerodrome-finance/contracts/v/1.0.0
- https://www.npmjs.com/package/@aerodrome-finance/contracts/v/1.1.0
- https://www.npmjs.com/package/@aerodrome-finance/contracts/v/1.1.1
- https://github.com/ossf/malicious-packages/blob/8b1ec19bee6eaef211ebd4375c98d15aead7cf1b/osv/malicious/npm/@aerodrome-finance/contracts/MAL-2026-13734.json
- https://o3.security/blog/crypto-defi-npm-supply-chain-attack-npmrc-exfiltration
- https://www.npmjs.com/package/@aerodrome-finance/contracts
- https://github.com/ossf/malicious-packages/blob/7d287226c4827ad7bbd142df678a71a6178b2386/osv/malicious/npm/@aerodrome-finance/contracts/MAL-2026-13734.json

Compromised versions (1)

= 1.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.