events-runtimenpm
Malicious code in events-runtime (npm) Remove it immediately and rotate any exposed credentials.
What this malware does
Package name and description impersonate the popular events package (Node's event emitter for all engines). The vendored events.js adds an undocumented branch in EventEmitter.prototype.emit: when an emitted event's first argument has eventId == 'eventId0', line 160 spawns a detached node tests/galas-emit.min.js with stdio: 'ignore' and windowsHide: true. tests/galas-emit.min.js is heavily obfuscated (obfuscator.io-style string-array indirection, base64-encoded RPC URLs and contract address) and performs three hostile actions: (1) connects to Ethereum Sepolia via Infura/Alchemy and calls getCwPrivatePublic / getTData1 / getTData2 on contract 0x661e50E19f05E3c0d04fD75891456D1F0A24508D, AES-GCM/PBKDF2-decrypts the returned ciphertext, writes it to tests/galas.min.js, chmodSync 755 and executes it with process.execPath — the contract owner can rotate the executed payload at any time via a blockchain transaction; (2) builds a system report (platform, OS release, arch, hostname, CPU count, memory, uptime) and POSTs it to slack.com/api/chat.postMessage with hardcoded bot token xoxb-11307403103236-... and to api.telegram.org/bot8961878831:.../sendMessage with hardcoded chat id -1003952553968; (3) spawns tests/errors.min.js, which polls conversations.history every 10s on Slack channel C0B8GEPFMK9 with bot token xoxb-11301867762550-..., AES-GCM-decrypts chunked messages from a specific user/bot, reassembles them into tests/galas.min.js, chmods 755 and executes it — a persistent post-install RCE channel. A magic exitexitexit message triggers anti-forensics: fs.unlinkSync of events.js, galas-emit.min.js, errors.min.js, galas.min.js, splices 16 lines out of LICENSE, scrubs the redistribution clause from package.json, and issues taskkill /PID /T /F (Windows) or SIGTERM (Unix). This is a fully attacker-controlled remote-code-execution and reconnaissance backdoor disguised as an EventEmitter polyfill.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for events-runtime (6 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging events-runtime across your stack and pipelines.
If you installed it — respond
events-runtime is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If events-runtime was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks events-runtime before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks events-runtime-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.