Malicious Code Vulnerability in hyperliquid-composer Package
Summary
MAL-2026-15627: Malicious code in hyperliquid-composer (npm). Affects hyperliquid-composer versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hyperliquid-composer package is an npm module designed for developers to facilitate interactions with Hyperliquid tooling. It is intended to streamline the development process by providing various utilities. However, this package has been identified to contain malicious code that compromises user data without consent.
Vulnerability Detail
The vulnerability originates from the bin/cli.js file within the hyperliquid-composer package. This file collects sensitive information, including the installer's username, hostname, and platform details, using the whoami and os.userInfo() functions. This data is then sent to a hardcoded Cloudflare Workers endpoint without user consent or configuration. The malicious behavior triggers upon requiring the module or invoking the CLI, posing significant risks to user privacy and security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall hyperliquid-composerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the hyperliquid-composer package until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the risk of malicious code.
Conclusion
The hyperliquid-composer package has been identified to contain malicious code that poses significant risks to user privacy. It is crucial for users to take immediate action by updating or removing the package and monitoring for any updates from the maintainers.
See every vulnerability recorded for hyperliquid-composer →
FAQ
The malicious code collects sensitive user information and sends it to an external server without consent.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring access to the code.
If you have installed hyperliquid-composer, it is recommended to uninstall it immediately and check for updates or alternatives.
Currently, there is no patch available for the identified vulnerability. Users should monitor the package repository for updates.
Using hyperliquid-composer can lead to unauthorized data exfiltration, compromising user privacy and potentially exposing sensitive information.
