14 Malicious npm Packages Impersonate Zentra Finance DeFi Ecosystem in Coordinated One-Minute Burst
Security researchers disclosed 14 malicious npm packages impersonating the Zentra Finance DeFi protocol, all published within the same minute on May 18, 2026, in a coordinated supply-chain attack targeting blockchain developers.
On May 18, 2026, security researchers disclosed 14 malicious npm packages in a tightly coordinated burst — every advisory was published within the same minute at 14:14 UTC. The packages all impersonate the legitimate Zentra Finance decentralized finance (DeFi) protocol, a project that provides smart-contract tooling and SDKs for blockchain applications.
The campaign signature is unmistakable: every package name either begins with the @zentrafinance/ npm scope, includes "zentra" or "citrea" as a prefix, or is a direct typosquat of known Zentra Finance module names. Representative examples include @zentrafinance/contracts, @zentrafinance/protocol-config, @zentrafinance/types, @zentrafinance/sdk, citrea-bridge, citrea-sdk, citrea-utils, clementine-sdk, zentra-finance, and zentra-sdk.
All 14 packages were first published on 2026-05-18 — the same day the advisories were issued — meaning they were registered and uploaded to the npm registry just hours before being flagged. None of the packages had accumulated significant download counts (most show between 21 and 37 weekly downloads, with lifetime totals under 2,000), suggesting the campaign was caught early before widespread adoption.
OpenSSF Package Analysis findings on these packages reveal consistent malicious behavior. The packages execute post-install scripts that communicate with remote hosts, exfiltrate environment variables, and deploy credential-harvesting routines. The behavioral profile matches a supply-chain attack aimed at developers working with blockchain and DeFi tooling — a high-value target given the financial assets often managed through such libraries.
Every GHSA advisory for these packages carries a Critical severity rating. The standard advisory language warns that any computer which installed these packages should be considered fully compromised, and all secrets, API keys, and cryptographic tokens stored on that machine must be rotated from a separate, trusted system.
The coordinated nature of the disclosure — all 14 advisories landing in the same minute — indicates a single takedown action by the npm security team or a security researcher who identified the entire campaign at once. The fact that all packages were published on the same day they were disclosed suggests the attacker registered them in bulk, likely via automated tooling, and may have been preparing to distribute them through social engineering or dependency confusion attacks targeting Zentra Finance users.
Developers who work with Zentra Finance or related blockchain tooling should immediately audit their package-lock.json, yarn.lock, or pnpm-lock.yaml files for any of the listed package names. If any of these packages are found in a project's dependency tree, the affected machine should be treated as compromised. All credentials, API tokens, and private keys should be rotated from a clean machine.
This campaign follows an increasing trend of supply-chain attackers targeting the Web3 and DeFi developer ecosystem. By impersonating well-known blockchain infrastructure packages, attackers aim to slip malicious code into CI/CD pipelines where it can exfiltrate wallet keys, smart-contract deployment credentials, and private repository access tokens. The tight coordination — 14 packages in under a minute — mirrors the operational tempo of automated typosquatting and dependency-confusion campaigns seen across npm, PyPI, and other registries in recent months.