Skip to main content
MalwarePublished Updated

analysis-chart (npm) · Malicious Code

Affects analysis-chartSource GCVE Database

0

Malicious package : remove analysis-chart and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 21:47 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6299

What to do

Remove analysis-chart from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
npmanalysis-chartAffected
  • 2.0.8 – 2.0.28
21 affected builds		Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'analysis-chart' contains a malicious postinstall script that downloads and executes attacker-controlled native code on Windows developer machines. The payload is XOR-decrypted and injected into memory, then executed. After execution, the script attempts to remove evidence by deleting files and removing the package from the host project. The package's API is a decoy, and author metadata appears fabricated.

References

Community reviews

Loading reviews…