rimraf-utils
This report shows the evidence for rimraf-utils@2.0.0. 3 of 3 known versions are blocked or flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-3772 confirms this npm version as malicious.
Advisory
MAL-2026-3772
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in rimraf-utils (npm)
Details
rimraf-utils@1.0.5 impersonates the widely-installed `rimraf` package (index.js is a dummy stub that internally identifies itself as 'lodash-js — Just a dummy module. The real payload is in postinstall.js'). On `npm install`, `scripts.postinstall` runs postinstall.js, which harvests installer-side secrets and ships them to a hardcoded bare-IP C2 over plaintext HTTP at `http://149.28.127.35:8888` (overridable via `process.env.C2_URL`).
Specific behavior in postinstall.js: - Reads `~/.npmrc` (npm auth tokens), `~/.env` (API keys, DB URLs, cloud credentials, payment keys, EVM private keys, webhooks), and `~/.git-credentials`. - Collects `os.hostname()` and `os.userInfo()` for host identification. - Enumerates 71 hardcoded Chrome/Brave/Edge/Firefox crypto-wallet extension IDs (MetaMask, Phantom, Coinbase, Trust, Exodus, Ledger Live, Trezor, Solflare, etc.) under the browsers' profile directories and reads each wallet's LevelDB `.log` files, regex-extracting `vault`/`seed`/`mnemonic`/`privateKey`/`encrypted`/`password` fields. - Recursively walks `~/Documents`, `~/Desktop`, `~/Downloads`, `~/OneDrive`, `~/Dropbox`, `~/Google Drive`, and `backup`/`keys`/`wallet`/`crypto` subtrees searching for seed-phrase and private-key patterns. - POSTs the aggregated JSON payload to the C2 via `http.request(...)`.
This package matches multiple unambiguous attack fingerprints simultaneously: hardcoded bare-IP plaintext-HTTP C2 invoked from a lifecycle hook; browser crypto-wallet extension-ID enumeration; seed-phrase/mnemonic home-directory scanner; and installer-secret regex extraction from `~/.npmrc`/`~/.env`/`~/.git-credentials`. The name is a typosquat of `rimraf` used as the delivery vector for the payload.
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to rimraf-utils@2.0.0.
The same advisory and Firewall decision cover 3 recorded versions
1.0.4, 1.0.5, 2.0.0
The versions list below shows the verdict for each recorded version.
- Avoid installing rimraf-utils@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.