abuden27 (npm) · Malicious Code
Affects abuden27Source GCVE Database
Malicious package : remove abuden27 and rotate any secrets on hosts that installed it.
Data as of 12 Sep 2026, 17:47 UTC
Malicious package
Published to npm · OSV MAL-2026-10276
What to do
Remove abuden27 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmabuden27 | Affected– | Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'abuden27' contains malicious code that abuses the npm registry by mass-publishing nearly 100 misleading package names. It includes a browser Service Worker that serves a heavily obfuscated web proxy frontend with a popunder redirect to a malicious site. The package does not auto-execute code during Node.js installation, so the primary harm is registry namespace abuse and browser-side malicious behavior when the assets are loaded. There is no evidence of installer-side compromise, but any system running this package should be considered fully compromised due to potential exposure of secrets and keys.
References
- github.com/advisories/GHSA-fw93-gc4v-qw63 (opens in a new tab)
- npmjs.com/package/abuden27/v/1.7.7 (opens in a new tab)
- npmjs.com/package/abuden27/v/1.1.7 (opens in a new tab)
- npmjs.com/package/abuden27/v/2.0.0 (opens in a new tab)
- safedep.io/malicious-npm-terminal3airport-proxy-adware-spam (opens in a new tab)