MalwarePublished 8 Jul 2026

airkey-mfa-react (npm) · Malicious Code

Affects airkey-mfa-reactSource GCVE Database

Malicious package : remove airkey-mfa-react and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 10:11 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6991

What to do

Remove airkey-mfa-react from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmairkey-mfa-react	Affected 20.0.1 – 36.1.1 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'airkey-mfa-react' versions 36.1.1, 35.1.1, 29.1.1, and 20.0.1 contain malicious code that executes during installation. It runs scripts that collect system information and user identity details, then exfiltrates this data to external malicious domains. The package appears to be part of a dependency-confusion attack targeting internal package namespaces. Systems with this package installed should be considered fully compromised.

Impact

Any system that installs or runs this package is considered fully compromised. The attacker gains access to sensitive system and user information, potentially enabling further exploitation. All secrets and keys stored on the compromised system should be assumed exposed and must be rotated immediately. Removing the package alone may not eliminate all malicious artifacts or backdoors introduced by the package.

Defensive guidance

Immediate removal of the 'airkey-mfa-react' package versions 36.1.1, 35.1.1, 29.1.1, and 20.0.1 is recommended. Systems with this package installed should be treated as compromised; rotate all secrets and keys from a secure, unaffected system. Conduct a thorough investigation for additional persistence mechanisms or malware. Monitor for any unusual outbound network traffic related to the identified malicious domains.

Summary

The 'airkey-mfa-react' npm package versions 36.1.1, 35.1.1, 29.1.1, and 20.0.1 include a preinstall script that auto-executes 'node test.js' on installation. This script collects username, hostname, platform, Node.js version, and CI environment flags, sending them to a malicious external domain. Additionally, the package runs system commands ('whoami' and 'id') to gather user and system context, which it also exfiltrates to another malicious domain. The exfiltrated payload includes a label indicating a dependency-confusion probe against an internal package namespace. The package's communications are linked to known malicious activity domains, confirming its malicious nature.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 10:11 UTC

Technical details

References

Community reviews