@velora-dex/sdk 9.4.1 build-pipeline backdoor

OpenSourceMalware found only @velora-dex/sdk 9.4.1 (Velora / formerly
ParaSwap) carrying a base64 child_process.exec in dist/index.js that
curls http://89.36.224.5/troubleshoot/mac/install.sh and runs it under
nohup. Dev tags 9.4.1-dev.1/2 and every other 9.x release were clean,
which OSM reads as a surgical build/release compromise, not a git
takeover. Payload runs on import. npm removed 9.4.1 after GitHub issue
233; 9.4.2 is clean.

Mapped techniques

T0121 Compromised legitimate artifact
T0159 Malicious artifact execution
T0206 Forge or omit build provenance
T0190 Weak encryption

supply-chain single-version dist implant

T0121 · Resource Development · Compromised legitimate artifact

Only the 9.4.1 tarball; source/dev builds clean.

T0159 · Execution · Malicious artifact execution

Runs on import via child_process.exec.

T0206 · Defense Evasion · Forge or omit build provenance

Implant appeared in the published dist, not matching dev tags.

T0190 · Collection · Weak encryption

C2 over unencrypted HTTP; base64 is not encryption.

@velora-dex/sdk 9.4.1 build-pipeline backdoor

Mapped techniques

supply-chain single-version dist implant

Sources