app-soda-layernpm
app-soda-layer is a confirmed malicious npm package (MAL-2026-11128) that steals credentials and exfiltrates sensitive data (malicious version 2.1.6). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in app-soda-layer (npm)
What this malware does
app-soda-layer 2.1.6 is an npm credential stealer and SSH backdoor that runs automatically on npm install through a postinstall hook (test.js). It harvests Solana keypairs (id.json), config.toml and .env secrets, then installs an operator-supplied SSH key into ~/.ssh/authorized_keys and opens port 22 for persistent access. Any host that installed it should be treated as compromised: check ~/.ssh/authorized_keys for the key below, check the firewall for a newly opened port 22, and rotate Solana keypairs, SSH keys and any secrets in reachable .env files. The package was purpose-built rather than a compromised library: its name and only version were created 284 ms apart with no earlier release, published 2026-07-27T18:47:46Z and unpublished by the author about 2.5 hours later, so it now returns 404 and survives only in sandbox capture.
The payload is a redeployment of the levex-refa/lint-builder toolkit documented in the February 2026 dev-protocol GitHub organization compromise, against new infrastructure. The exported function names, the authorized_keys/chown -R/ufw allow 22/tcp sequence, the /api/ssh-key, /api/scan-patterns, /api/block-patterns and /api/v1 endpoints, and the file-target list all match, and the same toolkit was reported in #1366 (polymarket-mcp-v2 2.1.6, C2 170.205.31.203). One routine POSTs a hardcoded id.json/config.toml/.env harvest to the C2 prefixed with the OS username; a second fetches a live pattern list and recursively uploads matches from the home directory, or from every logical drive on Windows via wmic/PowerShell. The infrastructure rotates per deployment while the code does not, so the stable indicators are the endpoint names and the injected SSH public key, whose comment field impersonates the support address of an unrelated company and is omitted here (match the base64 body): ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFYMx8MqdYTD/aZjqxmXo+9460+9EvsSjfiy9YAU+xwY. The pattern list retrieved live on 2026-07-28 was .env, .xls, .xlsx, privatekey, private key, seed, wallet, key, phrase, private (case-insensitive substring).
The package's postinstall hook (test.js) executes multiple malicious payloads on npm install. It walks the current working directory for files matching id.json, config.toml,.env, and env, and POSTs each to http://95.216.118.146:3000/api/v1 prefixed with the OS username. A second routine fetches attacker-controlled scan and block patterns from http://95.216.118.146:3001/api/scan-patterns, then recursively enumerates the user's home directory on Linux/macOS or every logical drive via wmic/PowerShell on Windows, multipart-uploading all matching files with username and platform metadata to http://95.216.118.146:3001/api/v1. On Linux, addSshKeyToUser() retrieves an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to $HOME/.ssh/authorized_keys, chowns ~/.ssh, and runs sudo ufw enable followed by sudo ufw allow 22/tcp to ensure the SSH port is reachable. Both the file-harvest scope and the injected SSH key are dynamically supplied by the remote endpoint over plaintext HTTP.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for app-soda-layer (version 2.1.6). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging app-soda-layer across your stack and pipelines.
If you installed it — respond
app-soda-layer is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If app-soda-layer was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks app-soda-layer before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- Robin Frehner, Protet · finder
Detect & block this
O3 blocks app-soda-layer-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.