MalwarePublished 13 Jul 2026Updated 1 Sep 2026

backup3-ff (npm) · Malicious Code

Affects backup3-ffSource GCVE Database

Malicious package : remove backup3-ff and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 17:47 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10287

What to do

Remove backup3-ff from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbackup3-ff	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package backup3-ff@2.0.0 contains multiple heavily obfuscated JavaScript bundles that do not align with its purported backup utility function. The obfuscated code includes UI page bundles such as AccountPage and SettingsPage, raising suspicion about malicious intent. There is no confirmed code path to verify credential harvesting or remote code execution, but the package is considered highly dangerous. Any system with this package installed should be treated as fully compromised, and all secrets and keys should be rotated from a separate, clean device.

Impact

Systems with the backup3-ff@2.0.0 package installed are considered fully compromised. The presence of heavily obfuscated code raises the risk of hidden malicious activities, including potential credential theft, data exfiltration, or remote code execution. The compromise may extend beyond the package itself, as attackers could have established persistent control over the affected system. Therefore, all secrets and keys stored on the compromised system must be rotated immediately from a separate, secure device.

Defensive guidance

Remove the backup3-ff@2.0.0 package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised systems from a different, secure computer. Because the system may be fully compromised, consider rebuilding the affected systems from a trusted backup or reinstalling the operating system to ensure complete removal of any malicious artifacts.

Summary

The npm package backup3-ff@2.0.0 ships with multiple heavily obfuscated JavaScript bundles under the assets/ directory, including AccountPage, DarkVeil, GamesPage, PlusBlockedNote, and SettingsPage. The obfuscation uses javascript-obfuscator-style hex identifiers (_0x-prefixed variable names). The package's name suggests a backup utility, but the included code bundles are UI-related and suspicious. There is no available traced code path to confirm or exclude malicious behaviors such as credential harvesting, exfiltration, or remote code execution. According to the ghsa-malware source, any computer with this package installed should be considered fully compromised, necessitating immediate secret and key rotation and package removal.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 17:47 UTC

Technical details

References

Community reviews