# Compromised maintainer backdoored package release

Trusted package release adding deps, install/build hooks, or startup files that execute attacker code

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; latest 2026-07-09. Updated 2026-10-23._

## How it works
A package release is assumed to be its maintainer's work and to run only what its manifest declares. That breaks when the maintainer account, token, or machine is compromised: the attacker publishes a version adding a dependency, an install/build hook, or a startup file, and the payload runs with the installer's or builder's full privileges. Name and version history stay legitimate, so trust in the name carries the attacker's code [E1](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-not-so-anonymous-telemetry-injectivelabs-sdk-ts-backdoor.md)[E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-cve-2024-3094-critical-rce-vulnerability-found-in-xz-utils.md)[E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-malicious-iolitelabs-vscode-extensions-target-solidity-developers-on-windows-macos-and-linux-with-b.md).

## Where it shows up
- A long-stable package gaining its first-ever dependency, especially a near-name of a popular one.
- A dependency never `require()`'d in source.
- Execution triggers, by phase: install-time `preinstall`/`postinstall` hooks; build-time `build.rs`, M4/configure macros, or tampered build config [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-cve-2024-3094-critical-rce-vulnerability-found-in-xz-utils.md); import/startup-time `.pth`, `sitecustomize.py`, `__init__.py` import hooks, or module-scope logger/gateway init [E1](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-not-so-anonymous-telemetry-injectivelabs-sdk-ts-backdoor.md).
- Provenance: SLSA `source_uri` host/owner not matching the canonical repo, or a clean tag paired with tampered build config [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-cve-2024-3094-critical-rce-vulnerability-found-in-xz-utils.md).
- Registry metadata: `_npmUser`/`trustedPublisher`/`gitHead` mismatch, or a long-lived token overriding OIDC.
- Orphan commits unreachable from main; wildcard-branch workflows with `id-token: write`.
- Example/test build files shipped in the tarball [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-cve-2024-3094-critical-rce-vulnerability-found-in-xz-utils.md).
- A dormant publisher reactivating with a sudden version bump, no matching GitHub commits, and a large VSIX size drop [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-malicious-iolitelabs-vscode-extensions-target-solidity-developers-on-windows-macos-and-linux-with-b.md).

## How to review
The invariant: every artifact traces to a reviewed commit by the canonical owner, and installing, building, or importing it executes nothing beyond its declared purpose. Diff published contents against the prior clean version and the git tag; compare SLSA `source_uri` host and owner against the canonical repo [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-cve-2024-3094-critical-rce-vulnerability-found-in-xz-utils.md). Confirm no unreachable commits or wildcard OIDC workflows. Verify OIDC is actually used and tokens lack `bypass_2fa` [E5]. Diff every bundled `node_modules` file against upstream package hashes rather than reading only the declared entry point [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-malicious-iolitelabs-vscode-extensions-target-solidity-developers-on-windows-macos-and-linux-with-b.md). Decode obfuscated strings and char-code arrays before trusting them [E1](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-not-so-anonymous-telemetry-injectivelabs-sdk-ts-backdoor.md).

## Variants seen
- Disguised telemetry module hooked into key-derivation functions, exfiltrating secrets [E1](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-not-so-anonymous-telemetry-injectivelabs-sdk-ts-backdoor.md).
- Build-time backdoor via obfuscated test fixtures and M4 macros in the release tarball [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-cve-2024-3094-critical-rce-vulnerability-found-in-xz-utils.md).
- Tampered bundled dependency activated on editor startup [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-malicious-iolitelabs-vscode-extensions-target-solidity-developers-on-windows-macos-and-linux-with-b.md).

## Why fixes fail
Manifest review alone misses payloads injected into bundled dependencies rather than the entry point [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-malicious-iolitelabs-vscode-extensions-target-solidity-developers-on-windows-macos-and-linux-with-b.md). A clean tag can coexist with tampered build config, so tag review is insufficient [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-cve-2024-3094-critical-rce-vulnerability-found-in-xz-utils.md).

## Impact and severity
Credential, wallet-key, and host compromise at install, build, or startup [E1](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-not-so-anonymous-telemetry-injectivelabs-sdk-ts-backdoor.md)[E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-cve-2024-3094-critical-rce-vulnerability-found-in-xz-utils.md)[E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-malicious-iolitelabs-vscode-extensions-target-solidity-developers-on-windows-macos-and-linux-with-b.md). Severity is high: execution is privileged and silent, and blast radius grows with token scope and distribution reach.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-not-so-anonymous-telemetry-injectivelabs-sdk-ts-backdoor.md
- E2: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-cve-2024-3094-critical-rce-vulnerability-found-in-xz-utils.md
- E3: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-malicious-iolitelabs-vscode-extensions-target-solidity-developers-on-windows-macos-and-linux-with-b.md