MAL-2026-3717 Malicious code in truffle-js (npm)

The package.json lifecycle script invokes require('child_process').execSync with a curl command at install time. Running curl through child_process during an npm install lifecycle hook causes any installer to execute remote content fetched over the network, without consent, as soon as npm install runs. The package name also resembles the widely-used 'truffle' Ethereum development toolkit, consistent with a typosquat lure. There is no legitimate reason for a small utility package to shell out to curl from its package.json install hook.

The OpenSSF Package Analysis project identified 'truffle-js' @ 2.0.0 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.