Malicious npm packages arc-contracts and evmos-contracts: hosts that installed them should be treated as compromised

Summary

On 6 November 2026 the GitHub malware advisory database, mirrored in OSV, flagged the npm packages arc-contracts (GHSA-qcjv-pgw5-h2f5, MAL-2026-18726) and evmos-contracts (GHSA-ch75-7hv2-w5hw, MAL-2026-18727) as malicious. Both names suggest smart-contract tooling. npm has replaced both with a "security holding package" (0.0.1-security).

Affected

• arc-contracts (npm), all versions. The npm registry history lists 7.7.7 and 7.7.8 (published 2026-04-09) and 0.0.0-stage (published 2026-11-06).
• evmos-contracts (npm), all versions. The npm registry history lists 7.7.7 (published 2026-04-07) and 0.0.0-stage (published 2026-11-06).
• Fixed in: no legitimate version exists. The packages are malicious in their entirety.

Impact

The advisories state that any computer that has these packages installed or running should be considered fully compromised. The advisories do not describe the payload, its indicators, or any confirmed victims or losses.

Recommended actions

• Search lockfiles, node_modules, private-registry mirrors and CI caches for arc-contracts or evmos-contracts, and remove them.
• If either was installed, rotate all secrets and keys stored on that machine from a different, clean computer, including deployer keys, wallet seed phrases, RPC and API tokens, and CI credentials. Move funds from wallets used on that host to new keys.
• Removing the package does not guarantee removal of other malicious software it may have installed. Rebuild affected hosts where possible.

Source & attribution

This 0xCERT advisory summarises entries in the GitHub Advisory Database malware feed, as mirrored by OSV: https://osv.dev/vulnerability/MAL-2026-18726 and https://osv.dev/vulnerability/MAL-2026-18727 (GHSA-qcjv-pgw5-h2f5, GHSA-ch75-7hv2-w5hw). Version history is from the npm registry. Details may change; refer to the original source for the authoritative record.