Supply chain · npm · High

Malicious npm package 'solidity-testing-utils' (v1.2.0) facilitates credential theft

Threat Engine Auto-Feed · data current as of 2026-08-23

The npm package 'solidity-testing-utils' version 1.2.0 contains malicious code that can lead to arbitrary code execution and credential theft. It masquerades as a testing utility but silently executes a script to fetch and run attacker-controlled JavaScript. Organizations using this specific version are at risk of compromise.

  • Package: npm / solidity-testing-utils
  • Affected versions: = 1.2.0
  • Severity: critical
  • Reach: ~135/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'solidity-testing-utils' version 1.2.0, despite presenting itself as a testing helper, includes malicious code. Its middleware factory in 'index.js' spawns a detached child process that fetches and executes arbitrary JavaScript from an attacker-controlled URL, enabling credential/secret theft.

How the attack works

This attack leverages a malicious package to achieve arbitrary code execution. When the affected package is installed and its malicious component is triggered, it initiates an out-of-band request to retrieve a dynamic payload. This payload is then executed within the installer's Node.js environment, allowing the attacker to perform actions such as stealing credentials or other sensitive data.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull npm dependencies
  • Any team whose projects directly or indirectly depend on 'solidity-testing-utils' version 1.2.0

Conditions that increase exposure

  • Projects with unpinned dependencies that might resolve to 'solidity-testing-utils@1.2.0'
  • Build systems that do not use lockfiles or have outdated lockfiles
  • Internal package mirrors that have not been updated to exclude the malicious version

Blast-radius scenarios

  • An attacker could gain access to environment variables, API keys, or other secrets available in the build or runtime environment where the package is installed.
  • The attacker could execute arbitrary commands, potentially leading to further system compromise or data exfiltration.
  • Compromised credentials could be used to access other internal systems or cloud resources, expanding the blast radius beyond the initial infection point.

What to do (defensive)

Detect

  • Scan dependency trees for 'solidity-testing-utils' version 1.2.0.
  • Monitor network traffic for outbound connections from build environments to suspicious URLs (e.g., 'https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f').
  • Review package integrity by comparing installed package contents against known good versions or expected behavior.

Contain

  • Immediately quarantine any systems or build environments found to have installed 'solidity-testing-utils' version 1.2.0.
  • Block network access from affected systems to the identified attacker-controlled domain.
  • Rotate any credentials or secrets that may have been exposed in environments where the package was installed or executed.

Remediate

  • Remove 'solidity-testing-utils' version 1.2.0 from all projects and dependency trees.
  • Update package lockfiles to explicitly exclude the malicious version and pin to known safe versions of all dependencies.
  • Implement strict dependency pinning and integrity checks (e.g., `npm ci` with a lockfile) in all build processes.

Frontier verdict — High

Prioritize immediate removal of 'solidity-testing-utils@1.2.0' due to critical severity and potential for arbitrary code execution and credential theft.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.