MAL-2026-10104: Malicious code in px8my (npm)
The npm package px8my contains malicious code that injects a full-viewport iframe pointing to a hardcoded external URL into any webpage that loads it via a CDN. The package does not provide any legitimate functionality and is designed solely to redirect users to a potentially harmful external site. It includes an automated script to rotate the redirect domain and purge CDN caches, indicating deliberate evasion of anti-abuse mechanisms. Multiple specific versions of px8my are affected.
AI Analysis
Technical Summary
The px8my npm package's main script (px.js) is a browser-only payload that appends an iframe to the document body, redirecting users to a hardcoded external URL (https://mfmz.ywdyxn.cn/H.html?c=0gjr). The package lacks any legitimate API and fails if required in Node.js environments. It also contains an automation script (update_px8my.sh) that modifies the redirect domain, increments the patch version, publishes the package, and purges the CDN cache on jsDelivr to maintain the malicious redirect's effectiveness. This combination of features establishes px8my as a purpose-built malicious distribution vehicle abusing npm and jsDelivr infrastructure to deliver browser redirects to users of any site including this script.
Potential Impact
Users of websites that include the px8my package via CDN are forcibly redirected to an external URL controlled by the attacker. This can lead to exposure to further malicious content, phishing, or other harmful activities. The package does not provide legitimate functionality and is solely designed to hijack web pages. There is no indication of known exploits in the wild yet.
Mitigation Recommendations
No official patch or remediation is currently available. Users and maintainers should immediately remove the px8my package from their dependencies and any web pages that load it. Avoid including this package from any source, especially CDNs like jsDelivr. Monitor for any new vendor advisories or updates regarding this package for potential fixes or further guidance.
MAL-2026-10104: Malicious code in px8my (npm)
Description
The npm package px8my contains malicious code that injects a full-viewport iframe pointing to a hardcoded external URL into any webpage that loads it via a CDN. The package does not provide any legitimate functionality and is designed solely to redirect users to a potentially harmful external site. It includes an automated script to rotate the redirect domain and purge CDN caches, indicating deliberate evasion of anti-abuse mechanisms. Multiple specific versions of px8my are affected.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The px8my npm package's main script (px.js) is a browser-only payload that appends an iframe to the document body, redirecting users to a hardcoded external URL (https://mfmz.ywdyxn.cn/H.html?c=0gjr). The package lacks any legitimate API and fails if required in Node.js environments. It also contains an automation script (update_px8my.sh) that modifies the redirect domain, increments the patch version, publishes the package, and purges the CDN cache on jsDelivr to maintain the malicious redirect's effectiveness. This combination of features establishes px8my as a purpose-built malicious distribution vehicle abusing npm and jsDelivr infrastructure to deliver browser redirects to users of any site including this script.
Potential Impact
Users of websites that include the px8my package via CDN are forcibly redirected to an external URL controlled by the attacker. This can lead to exposure to further malicious content, phishing, or other harmful activities. The package does not provide legitimate functionality and is solely designed to hijack web pages. There is no indication of known exploits in the wild yet.
Mitigation Recommendations
No official patch or remediation is currently available. Users and maintainers should immediately remove the px8my package from their dependencies and any web pages that load it. Avoid including this package from any source, especially CDNs like jsDelivr. Monitor for any new vendor advisories or updates regarding this package for potential fixes or further guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10104
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50ba3c68715ace4357db01
Added to database: 07/10/2026, 09:24:12 UTC
Last enriched: 07/10/2026, 09:32:45 UTC
Last updated: 07/10/2026, 09:32:45 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.