bcnfjndwbkf2 (npm) · Malicious Code
Affects bcnfjndwbkf2Source GCVE Database
Malicious package : remove bcnfjndwbkf2 and rotate any secrets on hosts that installed it.
Data as of 12 Aug 2026, 16:54 UTC
Malicious package
Published to npm · OSV MAL-2026-13783
What to do
Remove bcnfjndwbkf2 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmbcnfjndwbkf2 | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'bcnfjndwbkf2' version 1.0.0 contains malicious code that serves an obfuscated HTML redirect page mimicking a Cloudflare interstitial. This package does not execute code during installation or runtime in Node.js environments but redirects browser visitors who access the package via npm CDN mirrors to a potentially malicious URL. Although it does not represent a traditional supply-chain attack via npm install, the package abuses npm as a static host for browser-side redirection. One source claims that any system with this package installed or running should be considered fully compromised, recommending immediate secret rotation and package removal.