MalwarePublished 14 Jul 2026Updated 1 Sep 2026

akshajrawat.utils (npm) · Malicious Code

Affects akshajrawat.utilsSource GCVE Database

Malicious package : remove akshajrawat.utils and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 16:33 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10558

What to do

Remove akshajrawat.utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmakshajrawat.utils	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'akshajrawat.utils' contains malicious code that executes a postinstall script during installation. This script sends an unconditional HTTPS GET request to an external URL, transmitting the installer's HOME path and USERNAME as query parameters. This behavior constitutes a supply-chain exfiltration risk, potentially exposing sensitive environment information. Although the package may be a proof-of-concept or research artifact, the mechanism can be easily redirected to attacker-controlled hosts, posing a critical security risk to any system installing this package.

Impact

Any computer that installs or runs this package is considered fully compromised due to the exfiltration of environment variables that may include sensitive information. The presence of this package indicates a supply-chain compromise, and all secrets and keys stored on the affected system should be rotated immediately from a separate, trusted device. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors that may have been installed as a result.

Defensive guidance

The package should be removed immediately from any affected system. All secrets and credentials potentially exposed should be rotated from a different, secure computer. Exercise caution when installing npm packages, especially those not from trusted sources. Monitor for similar postinstall scripts in dependencies to prevent supply-chain exfiltration.

Summary

The 'akshajrawat.utils' npm package declares a postinstall lifecycle hook in its package.json that runs automatically on 'npm install'. This hook executes a Node.js command that sends an HTTPS GET request to 'https://example.com/collect', including the installer's environment variables HOME and USERNAME in the query string. This unconditional outbound transmission of installer-side identifiers is a canonical supply-chain exfiltration pattern. While the example.com domain and package description suggest a proof-of-concept, the underlying behavior is malicious and would compromise any system installing this package. The same code scaffold can be redirected to attacker-controlled hosts to exfiltrate sensitive information.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 16:33 UTC

Technical details

References

Community reviews