EN PT-BR
← Voltar ao feed
high technology software development

Forged commits plant preinstall dropper in hugo-paper and mevn-cli GitHub repos, fetching payload from buildwithknexus[.]xyz

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 21:00 · coletado há 1 hora

An attacker pushed forged commits into two unrelated GitHub projects, hugo-paper and mevn-cli, adding a malicious preinstall hook that downloads and runs a second-stage script from buildwithknexus[.]xyz whenever npm install or bun install is executed. The commits copy the author, date and message of legitimate tip commits, so history looks untouched. No npm package carries the payload, so registry scanners miss it. SafeDep infers stolen maintainer push credentials but has not confirmed this, and has not retrieved the second stage.

Detalhes técnicos

  • The hook is the first entry under scripts in package.json: node scripts/preinstall.js.
  • The loader uses curl -ks (TLS checks off, silent) to fetch /check_m (macOS/Linux, saved to /tmp/check and run in the background with nohup) or /check_w (Windows, saved to %TEMP%\check.cmd and run via cmd). All execSync calls use stdio ignore.
  • hugo-paper: on 2026-08-21 02:22 UTC the attacker force-pushed commit a68d2c9b over main, replacing merge commit de1169ec (PR #267). Tells: the "Verified" badge is gone and the commit has one parent instead of two.
  • mevn-cli: on 2026-08-20 11:23 UTC the attacker appended commits (eabf4d9, f883021 on develop; 3a30d0d, ceb4558 on master) that copy the preceding commit's metadata. Payload v1 used hidden PowerShell and likely broke on Windows. Payload v2 uses curl.exe and cmd /c. The last npm release (1.8.3, 2022) is clean.
  • Forks made after the attack inherit the payload. The activity is not linked to GlassWorm or ForceMemo: same git technique, but different tooling and no shared indicators.

Remediação

  • You are affected if you cloned or pulled the affected branches after the dates above and ran a package install without --ignore-scripts.
  • Treat the machine or CI runner as compromised. Look for /tmp/check, %TEMP%\check.cmd and any reference to buildwithknexus.xyz.
  • Rotate all reachable secrets: GitHub tokens, SSH keys, npm tokens, cloud credentials, .env files and browser-stored credentials.
  • Block buildwithknexus.xyz at DNS or proxy level and search egress logs for earlier connections.

Linha do tempo

  1. safedep.io ↗ · pub. 19/10/2026 21:00 · coletado 02/11 05:00 primeiro registro

    Forged commits plant preinstall dropper in hugo-paper and mevn-cli GitHub repos, fetching payload from buildwithknexus[.]xyz

    ler a análise desta fonte

    An attacker pushed forged commits into two unrelated GitHub projects, hugo-paper and mevn-cli, adding a malicious preinstall hook that downloads and runs a second-stage script from buildwithknexus[.]xyz whenever npm install or bun install is executed. The commits copy the author, date and message of legitimate tip commits, so history looks untouched. No npm package carries the payload, so registry scanners miss it. SafeDep infers stolen maintainer push credentials but has not confirmed this, and has not retrieved the second stage.

    Technical Details

    • The hook is the first entry under scripts in package.json: node scripts/preinstall.js.
    • The loader uses curl -ks (TLS checks off, silent) to fetch /check_m (macOS/Linux, saved to /tmp/check and run in the background with nohup) or /check_w (Windows, saved to %TEMP%\check.cmd and run via cmd). All execSync calls use stdio ignore.
    • hugo-paper: on 2026-08-21 02:22 UTC the attacker force-pushed commit a68d2c9b over main, replacing merge commit de1169ec (PR #267). Tells: the "Verified" badge is gone and the commit has one parent instead of two.
    • mevn-cli: on 2026-08-20 11:23 UTC the attacker appended commits (eabf4d9, f883021 on develop; 3a30d0d, ceb4558 on master) that copy the preceding commit's metadata. Payload v1 used hidden PowerShell and likely broke on Windows. Payload v2 uses curl.exe and cmd /c. The last npm release (1.8.3, 2022) is clean.
    • Forks made after the attack inherit the payload. The activity is not linked to GlassWorm or ForceMemo: same git technique, but different tooling and no shared indicators.

    Remediation

    • You are affected if you cloned or pulled the affected branches after the dates above and ran a package install without --ignore-scripts.
    • Treat the machine or CI runner as compromised. Look for /tmp/check, %TEMP%\check.cmd and any reference to buildwithknexus.xyz.
    • Rotate all reachable secrets: GitHub tokens, SSH keys, npm tokens, cloud credentials, .env files and browser-stored credentials.
    • Block buildwithknexus.xyz at DNS or proxy level and search egress logs for earlier connections.