MalwarePublished 19 Oct 2026Updated 29 Oct 2026

@an1mshnpmb9c84920/oidc-cross-cafb9d929e (npm) · Malicious Code

Affects @an1mshnpmb9c84920/oidc-cross-cafb9d929eSource GCVE Database

Malicious package : remove @an1mshnpmb9c84920/oidc-cross-cafb9d929e and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:35 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18047

What to do

Remove @an1mshnpmb9c84920/oidc-cross-cafb9d929e from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@an1mshnpmb9c84920/oidc-cross-cafb9d929e	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @an1mshnpmb9c84920/oidc-cross-cafb9d929e version 1.0.0 is identified as malicious. Although its code does not explicitly perform actions such as reading installer secrets, fetching or executing remote code, or opening backdoors, it is considered a severe threat. Installation of this package implies full compromise of the host system, requiring immediate secret and key rotation from a different machine. Removal of the package alone may not eliminate all resulting malicious software.

Impact

Systems with this package installed are considered fully compromised. All secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. The package's installation may have allowed an attacker full control over the system, and simply removing the package does not ensure removal of all malicious components.

Defensive guidance

Remove the @an1mshnpmb9c84920/oidc-cross-cafb9d929e package immediately. Rotate all secrets and keys that were stored on the compromised system from a different, secure computer. Due to the likelihood of full system compromise, further forensic analysis and remediation may be necessary beyond package removal.

Summary

The npm package @an1mshnpmb9c84920/oidc-cross-cafb9d929e@1.0.0 contains three files with no direct malicious behaviors observed in the code itself, such as secret exfiltration or remote code execution. However, security sources classify any system with this package installed or running as fully compromised, recommending immediate rotation of all secrets and keys from a separate device. The package appears to be part of a dependency-confusion probe or placeholder publication, but the presence of the package indicates a severe security incident. Removal of the package does not guarantee full remediation due to potential additional malicious software installed.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:35 UTC

Technical details

References

Community reviews