@ensdomains/ens-avatar
MAL-2025-190730
npmmalware11/24/2025
Description
Malicious code in @ensdomains/ens-avatar (npm)
Indicators of Compromise
SHA256 Hashes (4)
adafc00edb3e72e132be76f62e164ffa881a622a141cf7e58704299164dccf48
01d42aa5d8e1550b42c3f000d426b136d2f0a271a88bb0779306c670ab6c0613
0874f03db47c5b8a1a967b9387915cb0d6899ff54715cff55cafafb98ad00423
3041efc9c51c0fd075fb81c9150e629bca0cfe0c8f306b67b0e8b431a0a2ac68
References (4)
https://github.com/advisories/GHSA-pmf2-pqw2-xjc3OSVhttps://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomainsOSVhttps://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attackOSVhttps://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromisedOSV
Details
Ecosystemnpm
Attack Typemalware
Published11/24/2025
Aliases
GHSA-pmf2-pqw2-xjc3
Quick Actions