MalwarePublished 12 Aug 2026

bgzxcuite2 (npm) · Malicious Code

Affects bgzxcuite2Source GCVE Database

Malicious package : remove bgzxcuite2 and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:53 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13785

What to do

Remove bgzxcuite2 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbgzxcuite2	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package bgzxcuite2 version 1.0.0 contains malicious code that executes a browser-side redirect to a potentially harmful URL when its main HTML file is opened in a browser. The package does not execute any malicious code during installation or when imported in code, as it lacks lifecycle scripts and JavaScript entry points. However, the redirect behavior is consistent with phishing or traffic monetization tactics. Despite no direct attack on the installer's system during installation, the presence of this package on a computer is considered a full compromise, and all secrets and keys on the machine should be rotated immediately.

Impact

The malicious redirect only triggers when the index.html file is opened in a browser, not during installation or runtime in Node.js environments. However, the vendor advisory considers any system with this package installed as fully compromised, implying potential additional undetected malicious activity or risk. Secrets and keys stored on the compromised system may be exposed, necessitating immediate rotation. Removing the package alone may not eliminate all malicious components if the system is compromised.

Defensive guidance

Remove the bgzxcuite2 package version 1.0.0 from all systems. Immediately rotate all secrets and keys stored on any affected machines from a separate, uncompromised system. Because the vendor advisory warns that full compromise is possible, conduct a thorough investigation and remediation of the affected systems beyond just removing the package. Patch status is not applicable as this is a malicious package rather than a vulnerability with an official fix.

Summary

The npm package bgzxcuite2 version 1.0.0 includes an index.html file styled as a Cloudflare Turnstile challenge with an obfuscated inline script. Upon completion of the Turnstile widget, the script reconstructs a URL from an encoded array and redirects the browser using window.location.replace. The package does not execute this payload during npm install or require/import because it lacks lifecycle hooks and JavaScript entry points. This behavior suggests the package is used as a hosting channel for browser-side redirects, likely for phishing or traffic monetization. The package does not compromise the system at install time, but the vendor advisory states any system with this package installed should be considered fully compromised, recommending immediate secret/key rotation and package removal.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:53 UTC

Technical details

References

Community reviews