MAL-2026-13940
Malicious code in @opezneppelin/contracts (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (abe04ec28ed56cb0a253131129df8078d425f8a0c579c439ced9c75b6977a6ab) @opezneppelin/contracts is a typosquat of @openzeppelin/contracts. Its postinstall lifecycle script (scripts/postinstall.js) hex-escapes all module names, method names, and string constants (fs, https, child_process, powershell, -NoP,.exe) and stores the download URL as a base64 literal that decodes to https://files.catbox.moe/9bppy2.zip. On Windows installers, the script downloads that ZIP to %TEMP%, expands it via PowerShell Expand-Archive, recursively searches the extracted contents for the first.exe, and spawns it detached. The destination is an anonymous, mutable file-host (catbox.moe) unrelated to any OpenZeppelin infrastructure, and the fetched executable is opaque attacker-controlled content. The behavior fires automatically on npm install without any user action, resulting in arbitrary code execution on the installer's Windows host.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @opezneppelin/contracts (npm). Pin to a known-safe version or switch to an alternative.