glob-helper
This report shows the evidence for glob-helper@2.0.0. 7 of 7 known versions are blocked or flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-3764 confirms this npm version as malicious.
Advisory
MAL-2026-3764
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in glob-helper (npm)
Details
glob-helper@1.0.2 is a malicious typosquat with no legitimate functionality. Its index.js is a stub; package.json declares `scripts.postinstall: node postinstall.js`, which fires automatically on `npm install`. postinstall.js performs three concurrent credential-theft operations and POSTs the results as JSON over plain HTTP to a hardcoded bare-IP C2 at http://149.28.127.35:8888:
1. Reads ~/.npmrc (extracting _authToken and npm_* tokens), ~/.env (regex-matching NPM_TOKEN, NPM_AUTH_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN), and ~/.git-credentials. 2. Enumerates Chrome/Brave/Edge/Chromium/Vivaldi/Opera profile directories under ~/.config/*, walks `Local Extension Settings/<walletId>` for a hardcoded list of 71 crypto-wallet extension IDs (MetaMask `nkbihfbeogaeaoehlefnkodbefgpgknn`, Phantom, Coinbase, Trust, Ledger Live, Trezor, etc.), and greps log contents for `vault`, `seed`, `mnemonic`, `privateKey`, `password`, `encrypted`. 3. Walks ~/Documents, ~/Desktop, ~/Downloads for files whose names match `seed|backup|wallet|phrase|metamask|phantom|vault|key|private`, opens each, counts BIP39 wordlist matches, and includes file path + content preview in the exfil payload when 8+ BIP39 words are present.
The package.json keywords list `lodash` and the description is `Glob Helper utility helpers`, but index.js contains the author's own comment `lodash-js — Just a dummy module. The real payload is in postinstall.js`. Installing this package on any developer or CI machine leaks npm publish tokens, AWS keys, GitHub tokens, browser-stored wallet data, and any cryptocurrency seed backups present in the user's home directories.
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to glob-helper@2.0.0.
The same advisory and Firewall decision cover 7 recorded versions
1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 2.0.0
The versions list below shows the verdict for each recorded version.
- Avoid installing glob-helper@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.