noon-contracts

discovered 2026-05-10

noon-contracts is identified in the SafeDep analysis "noon-contracts npm Package: DeFi Supply Chain RAT". noon-contracts poses as a Noon Protocol SDK on npm. On install it exfiltrates SSH keys, crypto wallet private keys, AWS credentials (including live STS/S3/SecretsManager calls), Kubernetes secrets, .env files, shell history, and browser wallet paths to C2 at 82.221.101.203:8443. A full eval-based remote shell polls every 45 seconds. Triple persistence via crontab, macOS LaunchAgent, Linux systemd, and shell RC injection.

Threat types

credential stealer
data exfiltration
rat
persistence
c2 agent
crypto drainer

Malicious versions

1.0.0

Campaigns

No Specific Campaignattributed-to

Indicators

Techniques

Read the full analysis

APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API