moneykit-cardano-demonpm
Malicious code in moneykit-cardano-demo (npm) Remove it immediately and rotate any exposed credentials.
What this malware does
package.json declares preinstall: node index.js, which fires automatically on npm install. index.js collects host identifiers and OS files — os.hostname(), os.userInfo().username, home directory, DNS servers, /etc/passwd, /etc/hosts, and the consumer's full package.json — and HTTPS-POSTs the JSON payload to bixf8sa9rawbznh6ivppxl7k1b72vtji.oastify.com, a Burp Collaborator subdomain. The package ships no functionality matching its name; metadata is empty (no author, description, or license). The name moneykit-cardano-demo resembles an internal/private namespace and is consistent with a dependency-confusion reconnaissance package targeting an organization's internal scope. Installer harm: every npm install of this package leaks host identity, the local user account, OS-level files (/etc/passwd, /etc/hosts), and the consumer project's package.json contents to the attacker, providing target identification and the foothold data needed for follow-on attacks.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for moneykit-cardano-demo (version 1.1.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging moneykit-cardano-demo across your stack and pipelines.
If you installed it — respond
Remove moneykit-cardano-demo from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If moneykit-cardano-demo was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks moneykit-cardano-demo before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks moneykit-cardano-demo-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.