Protet Intel / npm / contracts-upgradeable
contracts-upgradeable 1.0.0
confirmed malicious
PROTET-NPM-2026-172
Every version of this package that Protet Intel names: Is contracts-upgradeable malicious?
Details
contracts-upgradeable takes the unscoped name of @openzeppelin/contracts-upgradeable. Its preinstall script runs 'node preinstall.js' on npm install, which sends the machine's hostname, the OS user name and the local time by HTTPS POST to a hardcoded Discord webhook. It has no functional code. Remove the package and treat the hostnames and user names of affected machines as disclosed. Also listed as MAL-2026-18451.
Records
- OSV record PROTET-NPM-2026-172
- Also reported in OSV as MAL-2026-18451
- Feeds: NDJSON, Atom
Status history
- 2026-11-07: named as a Protet finding