Malicious code in forge-jsx4 (npm)
forge-jsx4 is a remote access trojan (RAT) published to the public npm registry by the account rafael_silva ([email protected]). Versions 1.0.122 and 1.0.123 were published on June 21-22, 2026 as a reconstitution of the forge-jsx / forge-jsxy campaign, reusing the same command-and-control infrastructure and encryption after the earlier packages were taken down. The malware executes through a postinstall hook chain ("node scripts/postinstall-clipboard-event.mjs && node scripts/ensure-dist.mjs && node scripts/postinstall-durable-materialize.mjs && node scripts/postinstall-bootstrap.mjs && node scripts/postinstall-agent.mjs"), which runs automatically on npm install and skips CI environments to evade analysis. Once running it deploys a full RAT: system-wide keylogging via uiohook-napi, clipboard monitoring, .env file scanning, shell history collection, host inventory enumeration, desktop screenshot capture via jimp, and a WebSocket filesystem backdoor with remote file access. It scans the filesystem for cryptocurrency material (BIP39 mnemonics validated via checksum, Ed25519 Solana keypairs via tweetnacl, range-checked secp256k1 keys) and harvests browser-extension wallet databases across 21+ Chromium browsers (MetaMask, Phantom, Rabby). It establishes durable persistence outside node_modules (e.g. ~/.local/share/cfgmgr/.forge-jsxy/ on Linux, with macOS/Windows equivalents) plus autostart services (systemd user unit forge-js-worker.service, macOS LaunchAgent com.forgejs.worker.plist, Windows Task Scheduler ForgeJSWorker / HKCU Run key), so it survives npm uninstall, and supports relay-pushed auto-upgrades. Collected data is exfiltrated to a hardcoded C2 at 204.10.194.247 (WebSocket relay ws://204.10.194.247:9877, HTTP API http://204.10.194.247:8765, session password "secret"), to Discord bot webhooks (screenshots via ephemeral URLs), and to Hugging Face Hub repositories via the @huggingface/hub SDK. The payload uses an XOR-obfuscated AES-256-GCM key shared across all campaign waves.
Source: amazon-inspector
Package ships several files with patterns that warrant human inspection: a scripts/postinstall-agent.mjs invoked at install time, a dist/discordRelayUpload.js module with POST/ping/base64 patterns, a dist/relayServer.js, a dist/secretScan/agentStartupAudit.js that fetches from huggingface.co, and a dist/hfCredentials.js with base64 decode operations. The combination of an install-time agent script plus a relay/upload module plus a credentials helper is the kind of composition that can hide an installer-side data flow, but the package name (forge-jsx4) and the file naming suggest a developer-tool / agent / Hugging Face integration where many of these patterns may be legitimate (HF API endpoints, content-scanning helpers, build artifact relay). Without traced-code corroboration of where the postinstall agent points, what discordRelayUpload actually transmits, and whose credentials hfCredentials handles, the intent cannot be confirmed. Routing to human review so a maintainer can verify whether the postinstall script performs an outbound fetch to an attacker-controlled destination, whether discordRelayUpload silently exfiltrates caller-supplied data, and whether the embedded base64 blobs decode to executable payloads or to legitimate configuration.
