MalwarePublished 5 Aug 2026

afisha-storybook-default (npm) · Malicious Code

Affects afisha-storybook-defaultSource GCVE Database

Malicious package : remove afisha-storybook-default and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 17:07 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12336

What to do

Remove afisha-storybook-default from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmafisha-storybook-default	Affected 9.7.9 – 12.1.1 5 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package afisha-storybook-default contains malicious code that, when required, downloads and executes attacker-controlled binaries from obfuscated remote hosts. It uses base64-decoded payloads saved to temporary directories and executes them with elevated permissions. The package masquerades as a storybook default adapter but performs no legitimate functions, instead acting as a remote binary dropper that collects host-specific fingerprint data and transmits it to attacker infrastructure.

Impact

Installing or requiring this package results in arbitrary code execution on the host system via remote binary download and execution. The attacker gains the ability to run platform-specific payloads with the permissions of the Node.js process, potentially leading to full system compromise. The collection and transmission of host fingerprint data also enables attacker tracking and targeted follow-up attacks.

Defensive guidance

Users should immediately remove afisha-storybook-default from their dependencies and avoid installing or requiring it. Verify the integrity and provenance of npm packages before use, and consider using package allowlists or trusted registries. Monitor for any unusual child process executions or unexpected network connections to domains such as package-proxy.cf*.workers.dev and well1.site.

Summary

The afisha-storybook-default npm package includes a malicious setup.js script that invokes a telemetry module to fetch obfuscated binaries from multiple attacker-controlled mirror hosts. These binaries are base64-decoded, saved under temporary directories with executable permissions, and launched via child_process. The package dynamically constructs domain names and API calls to evade static detection. It also generates an install fingerprint using host identifiers (hostname, username, current working directory, Node.js version, process ID) and sends this data to the dropper infrastructure. The package exports empty class methods, meaning its only effect is the remote fetch-and-execute behavior without any legitimate functionality. No integrity checks such as pinning, hashing, or signature verification are performed on the downloaded payloads.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:07 UTC

Technical details

References

Community reviews