MalwarePublished 12 Jul 2026

auto-debug-tool (npm) · Malicious Code

Affects auto-debug-toolSource GCVE Database

Malicious package : remove auto-debug-tool and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10209

What to do

Remove auto-debug-tool from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmauto-debug-tool	Affected =1.0.3 =1.0.2 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'auto-debug-tool' versions 1.0.0, 1.0.2, and 1.0.3 contains malicious code that executes automatically during installation on Windows systems. The package.json defines a postinstall hook that runs a hidden PowerShell command to download and execute an unsigned binary from a mutable branch of a personal GitHub repository. This execution is concealed by skipping non-Windows platforms and development environments, and by swallowing errors, allowing the payload to remain dormant on developer machines while activating on Windows installations and CI environments.

Impact

The malicious postinstall script can lead to arbitrary code execution on Windows systems during package installation, potentially compromising the host system. Because the executable is downloaded from a mutable and untrusted source without verification, it may be replaced or updated by the attacker at any time, increasing the risk of persistent or evolving malicious payloads. The concealment techniques reduce the likelihood of detection during development or on non-Windows platforms, increasing the chance of successful compromise in production or CI environments.

Defensive guidance

Users should avoid installing versions 1.0.0, 1.0.2, and 1.0.3 of 'auto-debug-tool'. Inspect package.json files for suspicious postinstall scripts, especially those invoking hidden PowerShell commands or downloading executables from untrusted sources. Consider removing or replacing this package with a trusted alternative. Monitor for updates from the package maintainer or vendor advisory for any official fixes or guidance.

Summary

The 'auto-debug-tool' npm package versions 1.0.0, 1.0.2, and 1.0.3 includes a postinstall script that triggers a hidden PowerShell process on Windows to download and run an executable from an unverified source on GitHub. The downloaded binary's publisher does not match the npm package publisher, and no integrity checks are performed on the fetched executable. The malicious behavior is gated to avoid execution on non-Windows platforms and when NODE_ENV is set to development, with errors suppressed to conceal the activity. This design enables the payload to evade detection during development and activate only in targeted environments.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Jul 2026, 09:57 UTC

Technical details

References

Community reviews