MAL-2026-13940

    Dashboard / Malicious Package / MAL-2026-13940

    MAL-2026-13940

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in @opezneppelin/contracts (npm)

    Details: Source: amazon-inspector (abe04ec28ed56cb0a253131129df8078d425f8a0c579c439ced9c75b6977a6ab) @opezneppelin/contracts is a typosquat of @openzeppelin/contracts. Its postinstall lifecycle script (scripts/postinstall.js) hex-escapes all module names, method names, and string constants (fs, https, child_process, powershell, -NoP,.exe) and stores the download URL as a base64 literal that decodes to https://files.catbox.moe/9bppy2.zip. On Windows installers, the script downloads that ZIP to %TEMP%, expands it via PowerShell Expand-Archive, recursively searches the extracted contents for the first.exe, and spawns it detached. The destination is an anonymous, mutable file-host (catbox.moe) unrelated to any OpenZeppelin infrastructure, and the fetched executable is opaque attacker-controlled content. The behavior fires automatically on npm install without any user action, resulting in arbitrary code execution on the installer's Windows host.

    References: https://www.npmjs.com/package/@opezneppelin/contracts/v/5.0.2

    Affected packages

    Package

    Name: @opezneppelin/contracts

    Purl: pkg:npm/%40opezneppelin/contracts

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    5.0.2
    MAL-2026-13940 | CVE-DB