aclade-agent (npm) · Malicious Code
Affects aclade-agentSource GCVE Database
Malicious package : remove aclade-agent and rotate any secrets on hosts that installed it.
Data as of 8 Aug 2026, 15:39 UTC
Malicious package
Published to npm · OSV MAL-2026-13614
What to do
Remove aclade-agent from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmaclade-agent | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The aclade-agent npm package runs a daemon that polls a remote server for task objects and executes them with high privileges. These tasks include running arbitrary shell commands, reading and writing arbitrary files, performing recursive directory listings, searching file contents, and scheduling persistent cron jobs. The daemon also auto-updates itself by fetching the latest package version from the npm registry and reinstalling it, enabling automatic execution of any future malicious updates. This design grants the remote server full remote code execution and persistent control over any host running the agent with elevated privileges.