@validate-pubkey/hex

MAL-2025-190634

npmmalware11/24/2025
Description

Malicious code in @validate-pubkey/hex (npm)

Indicators of Compromise
SHA256 Hashes (4)
6f8ef709a4966e774d65016f58b5e36c55025bd86443d23dc11e837cc563f2fc
05db2afe6b0d7557f2c2153dd15df68ab69667e8402bf92f2b2e2d900eb5728f
15821f9b7e961d4e8653a1d3b77fdd7f85275790a0eaf30f6f3a769aba3417e3
acb86fe2dc7f27799bc3e515e1e35b2a0d3ee4b9273328afa4823c723495c0de
References (4)
https://github.com/advisories/GHSA-4f7x-m25q-x292OSVhttps://security.snyk.io/vuln/SNYK-JS-VALIDATEPUBKEYHEX-14102887OSVhttps://npmjs.com/package/@validate-pubkey/hexOSVhttps://research.jfrog.com/post/new-crypto-stealer-npmOSV
Details
Ecosystemnpm
Attack Typemalware
Published11/24/2025
Aliases
GHSA-4f7x-m25q-x292SNYK-JS-VALIDATEPUBKEYHEX-14102887
Quick Actions
All Incidentsnpm Incidents
Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives
PoC for every finding
30+ tools orchestrated
Book a DemoLearn More
Setup in 5 minutesSOC 2 & ISO 27001