joi-pack
This report shows the evidence for joi-pack@1.0.5. 3 of 3 known versions are blocked or flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-3765 confirms this npm version as malicious.
Advisory
MAL-2026-3765
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in joi-pack (npm)
Details
The package declares a postinstall hook (`"postinstall": "node postinstall.js"` in package.json) that runs unconditionally on `npm install`. The script's own header calls itself a "Token harvester + Crypto wallet scanner / Runs on npm install. Silent. Zero trace." It performs two distinct credential-theft behaviors:
1) Installer secret harvest: reads `~/.npmrc`, `~/.env`, and `~/.git-credentials`; extracts npm auth tokens (regex `npm_[a-zA-Z0-9]{36}`), API keys, database URLs, cloud credentials, EVM private keys (`0x[a-fA-F0-9]{64}`), and git credentials; POSTs the JSON result to the hardcoded bare-IP endpoint `http://149.28.127.35:8888` over plain HTTP (configurable only via `C2_URL` env).
2) Crypto wallet stealer: enumerates 71 hardcoded Chrome/Brave/Edge/Firefox wallet extension IDs (MetaMask `nkbihfbeogaeaoehlefnkodbefgpgknn`, Phantom `bfnaelmomeimhlpmgjnjophhpkkoljpa`, Coinbase, Trust, Ledger, etc.), walks browser profile `Local Extension Settings/<walletId>` LevelDB `.log` files matching regex for `vault`, `mnemonic`, `seed`, `privateKey`, `password`, `encrypted`, and recursively scans `~/Documents`, `~/Desktop`, `~/Downloads`, `~/OneDrive`, `~/Dropbox`, `~/Google Drive`, `~/backup`, `~/keys`, `~/wallet`, `~/crypto` for seed-phrase and keystore files, exfiltrating hits to the same C2.
The package's advertised purpose (`keywords: [lodash, utilities]`, description "Lodash JavaScript utilities bundle", internal name `lodash-js`) does not match the name `joi-pack` and does not match the payload — `index.js` is an explicit stub ("Just a dummy module. The real payload is in postinstall.js"). Name and keywords are cover-story framing piggybacking on the popular `joi` and `lodash` packages.
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to joi-pack@1.0.5.
The same advisory and Firewall decision cover 3 recorded versions
1.0.3, 1.0.4, 1.0.5
The versions list below shows the verdict for each recorded version.
- Avoid installing joi-pack@1.0.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.