Last Updated: 2026-08-05T22:02:21Z
What’s Happening
Starting on the morning of 2026-08-04T07:00:00Z, multiple npm packages were impacted by a new worming package payload. The initial compromise of 11 packages appears to have wormed to at least 424, per Step Security.
OpenSourceMalware and Socket are also covering the attack.
Step provides differentiating context for this attack from prior ones:
What sets this attack apart from the axios compromise of March 2026 is that the headline packages were published through npm’s OIDC Trusted Publishing with valid SLSA provenance attestations. In the axios incident, the absence of provenance was the telltale signal. Here, the attacker compromised the maintainer’s GitHub account, pushed poisoned release commits and tags, and let the projects’ own release workflows ship the malware, cryptographically attested and indistinguishable from legitimate releases by any automated provenance check. Provenance proves which commit was built. It cannot prove the commit was authorized.
Actions
As usual, review the (very long) list of packages/versions for presence in your environment. Initiate rotations/incident response processes as appropriate.
Review the listed GitHub indicators for suspicious activity as well.
Indicators
While nobody is willing to say so, RPC Endpoint activity should be considered malicious. Here’s a list of known Ethereum RPC endpoints.
| Value | Type | Description |
|---|---|---|
1rpc[.]io |
Domain | RPC Endpoint, |
api.bitstack[.]com |
Domain | RPC Endpoint, |
api.mycryptoapi[.]com |
Domain | RPC Endpoint, |
api.securerpc[.]com |
Domain | RPC Endpoint, |
api.zmok[.]io |
Domain | RPC Endpoint, |
beta-be.gashawk[.]io |
Domain | RPC Endpoint, |
cloudflare-eth[.]com |
Domain | RPC Endpoint, |
eth.api.onfinality[.]io |
Domain | RPC Endpoint, |
eth.drpc[.]org |
Domain | RPC Endpoint, |
ethereum.blockpi[.]network |
Domain | RPC Endpoint, |
ethereum.publicnode[.]com |
Domain | RPC Endpoint, |
ethereum-rpc.publicnode[.]com |
Domain | RPC Endpoint, |
eth.llamarpc[.]com |
Domain | RPC Endpoint, |
eth-mainnet.nodereal[.]io |
Domain | RPC Endpoint, |
eth-mainnet.public.blastapi[.]io |
Domain | RPC Endpoint, |
eth-mainnet.rpcfast[.]com |
Domain | RPC Endpoint, |
eth.meowrpc[.]com |
Domain | RPC Endpoint, |
eth.rpc.blxrbdn[.]com |
Domain | RPC Endpoint, |
eth-rpc.gateway.pokt[.]network |
Domain | RPC Endpoint, |
go.getblock[.]io |
Domain | RPC Endpoint, |
mainnet.gateway.tenderly[.]co |
Domain | RPC Endpoint, |
mainnet.infura[.]io |
Domain | RPC Endpoint, |
mainnet.infura[.]io |
Domain | RPC Endpoint, |
rpc.ankr[.]com |
Domain | RPC Endpoint, |
rpc.blocknative[.]com |
Domain | RPC Endpoint, |
rpc.builder0x69[.]io |
Domain | RPC Endpoint, |
rpc.flashbots[.]net |
Domain | RPC Endpoint, |
rpc.mevblocker[.]io |
Domain | RPC Endpoint, |
rpc.payload[.]de |
Domain | RPC Endpoint, |
singapore.rpc.blxrbdn[.]com |
Domain | RPC Endpoint, |
uk.rpc.blxrbdn[.]com |
Domain | RPC Endpoint, |
virginia.rpc.blxrbdn[.]com |
Domain | RPC Endpoint, |
Notes
I’m very tired of this attack.
Open source malware’s report has been updated with a useful deep dive.
JFrog added an analysis.
Not to be left out, so did Elastic.