Malicious Package Affecting @tinyfox/shapecheck package, versions =0.7.4=0.8.5=0.8.6=0.8.7=0.8.8
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-TINYFOXSHAPECHECK-17817797
- published5 Jul 2026
- disclosed4 Jul 2026
Introduced: 4 Jul 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the @tinyfox/shapecheck package.
Overview
@tinyfox/shapecheck is a malicious package.
This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary.
Impact
The infostealer targets crypto wallets, browser credentials, cloud tokens, SSH keys, and developer credentials (npm, .env, GitHub/PyPI tokens). It installs persistence via a disguised systemd service and exfiltrates data over Telegram or HTTP. Some versions trigger at runtime, allowing the payload to survive --ignore-scripts.
Note
This package is part of a larger campaign, involving many packages published from disposable
@wshu.netaccounts.This actor has also been linked to attempts to compromise AI-powered workflows.
Malicious versions were hidden behind scrubbed
latesttags, so treat all versions as untrusted.