MalwarePublished 27 Apr 2026Updated 4 May 2026

@activation_code/error (npm) · Malicious Code

Affects @activation_code/errorSource GCVE Database

Malicious package : remove @activation_code/error and rotate any secrets on hosts that installed it.

Data as of 27 Oct 2026, 01:10 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-3107

What to do

Remove @activation_code/error from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@activation_code/error	Affected =99.0.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package '@activation_code/error' version 99.0.3 has been identified as containing malicious code. Installation or execution of this package can lead to a full compromise of the affected computer. It is recommended to remove the package and immediately rotate all secrets and keys from a different, uncompromised machine. However, removal of the package may not fully eliminate all malicious software introduced by it.

Impact

Any system with the '@activation_code/error' package version 99.0.3 installed or running should be considered fully compromised. Attackers may have gained full control over the system, risking exposure of all stored secrets and keys. This can lead to unauthorized access, data theft, and further system manipulation.

Defensive guidance

Remove the '@activation_code/error' package version 99.0.3 immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure computer. Because full system compromise is possible, consider rebuilding or thoroughly cleaning the affected system to ensure all malicious components are removed.

Summary

The package '@activation_code/error' version 99.0.3 on npm has been flagged as malicious by multiple sources including Amazon Inspector, GHSA Malware, and the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior, which can lead to a complete compromise of the host system. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors installed by the package.

References

github.com/advisories/GHSA-hrpv-vm88-vgfx (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 27 Oct 2026, 01:10 UTC

Technical details

References

Community reviews