-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0320
============================================================

Advisory-ID:  0xCERT-2026-0320
Severity:     Medium
Published:    2026-11-06T16:53:17.000Z
Updated:      2026-11-06T20:44:00.518Z
Chains:       n/a
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0320

Title: Malicious npm packages arc-contracts and evmos-contracts: hosts that installed them should be treated as compromised

Summary
- -------
The npm packages arc-contracts and evmos-contracts, whose names suggest smart-contract tooling, were flagged as malicious (MAL-2026-18726 / GHSA-qcjv-pgw5-h2f5, MAL-2026-18727 / GHSA-ch75-7hv2-w5hw) and replaced by npm with security holding packages. Remove them and rotate any keys on machines that installed them.

Details
- -------
Summary
On 6 November 2026 the GitHub malware advisory database, mirrored in OSV, flagged the npm packages arc-contracts (GHSA-qcjv-pgw5-h2f5, MAL-2026-18726) and evmos-contracts (GHSA-ch75-7hv2-w5hw, MAL-2026-18727) as malicious. Both names suggest smart-contract tooling. npm has replaced both with a "security holding package" (0.0.1-security).

Affected
- - arc-contracts (npm), all versions. The npm registry history lists 7.7.7 and 7.7.8 (published 2026-04-09) and 0.0.0-stage (published 2026-11-06).
- - evmos-contracts (npm), all versions. The npm registry history lists 7.7.7 (published 2026-04-07) and 0.0.0-stage (published 2026-11-06).
- - Fixed in: no legitimate version exists. The packages are malicious in their entirety.

Impact
The advisories state that any computer that has these packages installed or running should be considered fully compromised. The advisories do not describe the payload, its indicators, or any confirmed victims or losses.

Recommended actions
- - Search lockfiles, node_modules, private-registry mirrors and CI caches for arc-contracts or evmos-contracts, and remove them.
- - If either was installed, rotate all secrets and keys stored on that machine from a different, clean computer, including deployer keys, wallet seed phrases, RPC and API tokens, and CI credentials. Move funds from wallets used on that host to new keys.
- - Removing the package does not guarantee removal of other malicious software it may have installed. Rebuild affected hosts where possible.

Source & attribution
This 0xCERT advisory summarises entries in the GitHub Advisory Database malware feed, as mirrored by OSV: https://osv.dev/vulnerability/MAL-2026-18726 and https://osv.dev/vulnerability/MAL-2026-18727 (GHSA-qcjv-pgw5-h2f5, GHSA-ch75-7hv2-w5hw). Version history is from the npm registry. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://osv.dev/vulnerability/MAL-2026-18726
- - https://osv.dev/vulnerability/MAL-2026-18727
- - GHSA-qcjv-pgw5-h2f5
- - GHSA-ch75-7hv2-w5hw
- - https://github.com/advisories/GHSA-qcjv-pgw5-h2f5
- - https://github.com/advisories/GHSA-ch75-7hv2-w5hw
- - https://www.npmjs.com/package/arc-contracts
- - https://www.npmjs.com/package/evmos-contracts

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrvUIoJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcme2AWmSh/5I0o8QXflt34HuiSBQTXmoCaMQsk0U
QcBr6BYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAAfYwD/ZHMcEYnQLo7EKcsK
SlIB5ih8Py1mvZ4cuiVW5qyB8BcA/iPen/EdCy/8mLPKIY9k7u3UgPSZbD5p
5SmrByIzMzIO
=yrYT
-----END PGP SIGNATURE-----