MalwarePublished 12 Aug 2026

@bikli/bikli (npm) · Malicious Code

Affects @bikli/bikliSource GCVE Database

Malicious package : remove @bikli/bikli and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:55 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13778

What to do

Remove @bikli/bikli from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@bikli/bikli	Affected 1.1.5 – 1.1.10 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @bikli/bikli versions 1.1.5, 1.1.6, 1.1.8, and 1.1.10 contain malicious code. Installation or execution of these versions may result in full compromise of the affected system. Secrets and keys stored on the compromised system should be rotated immediately from a different, trusted machine. Removal of the package does not guarantee complete eradication of the malicious presence. No specific patch or fix is currently documented.

Impact

Systems with the affected package versions installed or running are considered fully compromised. Attackers may have gained full control over the system, risking exposure of all stored secrets and keys. The compromise is severe enough that simply removing the package may not remove all malicious software or backdoors introduced. Immediate secret rotation from a clean environment is necessary to mitigate credential exposure.

Defensive guidance

Immediate removal of the affected package versions (@bikli/bikli 1.1.5, 1.1.6, 1.1.8, 1.1.10) is recommended. All secrets and keys stored on the compromised system should be rotated immediately from a different, trusted machine. Given the potential full system compromise, consider rebuilding or thoroughly cleaning affected systems to ensure removal of all malicious artifacts.

Summary

The npm package @bikli/bikli in versions 1.1.5, 1.1.6, 1.1.8, and 1.1.10 has been identified as containing malicious code. According to the GHSA malware source, any system with this package installed or running should be considered fully compromised, with potential full control given to an attacker. The Amazon Inspector source did not find static or traced indicators of supply-chain attack behavior such as lifecycle scripts fetching remote content or credential scraping, but the GHSA malware advisory indicates severe compromise risk.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:55 UTC

Technical details

References

Community reviews