MalwarePublished 10 Sep 2025Updated 30 Oct 2025

airbnb-slider (npm) · Malicious Code

Affects airbnb-sliderSource GCVE Database

Malicious package : remove airbnb-slider and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 22:57 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-47011

What to do

Remove airbnb-slider from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmairbnb-slider	Affected =13.68.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The airbnb-slider npm package version 13.68.2 contains malicious code that installs a dependency from a custom domain which executes an information stealer during installation. This malware targets sensitive tokens related to npm, git, and CI/CD environments. Systems with this package installed should be considered fully compromised, and all secrets and keys must be rotated immediately from a secure machine. Removing the package alone does not guarantee removal of all malicious components.

Impact

Any computer with airbnb-slider version 13.68.2 installed is considered fully compromised. The attacker gains access to sensitive tokens and secrets related to npm, git, and CI/CD pipelines, which can lead to further unauthorized access and control. The compromise is severe enough that simply removing the package does not ensure complete remediation.

Defensive guidance

Immediately remove the airbnb-slider package version 13.68.2 from all systems. Rotate all secrets, keys, and tokens that were stored or used on the compromised systems from a different, secure computer. Because the system is considered fully compromised, further forensic analysis and remediation may be necessary to ensure all malicious components are eradicated.

Summary

The airbnb-slider package version 13.68.2 is identified as malicious. During installation, it pulls a dependency from a custom domain that runs an info stealer focused on extracting npm, git, and CI/CD tokens. This results in a full compromise of the affected system, potentially exposing all stored secrets and keys. The malicious behavior is embedded in the package installation process, making it a supply chain threat in the npm ecosystem.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 22:57 UTC

Technical details

References

Community reviews