MAL-2026-13775

permit2 is a malicious npm package that squats the bare name of Uniswap's Permit2 token-approval system (whose legitimate npm distribution is the scoped `@uniswap/permit2-sdk`), advertising itself as a "smart contract development toolkit." The package contains no real functionality — the published tarball ships only a package.json and an install-time payload (index.js), which both `preinstall` and `postinstall` execute via `node index.js`, so it runs automatically on `npm install`.

The payload is a more aggressive variant of the infostealer used across the `mssjeep843` DeFi-impersonation campaign and exfiltrates to the same `webhook.site` endpoint. It collects environment variables whose names match a broadened secret pattern (`KEY|TOKEN|SECRET|PASS|PRIVATE|MNEMONIC|RPC|AWS|GITHUB|NPM|KUBE|VAULT|AUTH|PGP|GPG|SEED|WALLET|BEARER|API|INFURA|ALCHEMY|HELIUS|QUICKNODE|ANKR|PRIVATE_KEY`) and, rather than merely listing credential directories, reads and exfiltrates the full contents (up to 4000 bytes each) of a wide set of credential and key files: `~/.aws/credentials` and `~/.aws/config`, SSH private keys (`~/.ssh/id_rsa`, `~/.ssh/id_ed25519`) and `~/.ssh/config`, `~/.kube/config`, `~/.docker/config.json`, `~/.netrc`, `~/.pgpass`, `~/.npmrc`, `~/.pypirc`, `~/.gitconfig`, `~/.git-credentials`, GCP application-default and legacy credentials, Solana/Anchor keypairs (`id.json`), NEAR credentials, the Sui keystore, up to three Foundry keystore files, and `.env`/`.env.local`/`.env.production`/`.env.development`/`secrets.env` from the current working directory. It also captures the hostname, username, cwd and platform. The JSON is POSTed over HTTPS to `https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09`, with errors swallowed so the install never visibly fails. Any host that installed this package should treat SSH keys, cloud credentials, wallet keystores and `.env` secrets as compromised and rotate them.

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (51baca54ac515b4ff006cc3c6b99645d5f38f8c0250a294b8abe75c9d3172f2b) The npm package 'permit2' (a name-squat of Uniswap's Permit2) ships an index.js that is registered as both preinstall and postinstall in package.json. On install, index.js enumerates environment variables matching KEY/TOKEN/SECRET/PRIVATE/MNEMONIC/AWS/GITHUB/NPM and reads installer-owned credential files including ~/.aws/credentials, ~/.ssh/id_*, ~/.npmrc, ~/.kube, ~/.docker, ~/.netrc, ~/.gitconfig, gcloud/solana/sui/anchor credentials, foundry keystores, and local.env files. The collected data is POSTed via https.request to a hardcoded attacker endpoint at webhook.site (path /326b0891-2093-4800-a4c1-686ce3e07b09). The upload is deferred 60-240 seconds inside a detached child process (spawn with detached:true, stdio:'ignore') to outlive install/scanner windows, and the script early-exits if os.hostname()/user matches sandbox patterns (scan-, detonation, sandbox, ubuntu-fc-uvm) or if the npm registry points at a mirror. The package ships no functionality matching its self-description as a 'smart contract development toolkit'.