bmgki3g6fh3 (npm) · Malicious Code
Affects bmgki3g6fh3Source GCVE Database
Malicious package : remove bmgki3g6fh3 and rotate any secrets on hosts that installed it.
Data as of 12 Aug 2026, 16:53 UTC
Malicious package
Published to npm · OSV MAL-2026-13789
What to do
Remove bmgki3g6fh3 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmbmgki3g6fh3 | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'bmgki3g6fh3' version 1.0.0 contains malicious code embedded in an index.html file that renders a spoofed Cloudflare security verification page. When a browser loads this page, it executes obfuscated JavaScript that redirects the user to a constructed URL, facilitating phishing or redirect attacks. The package does not execute code during installation or require time, so it does not pose a supply-chain risk through npm install or require(). This is a case of registry abuse to host phishing infrastructure rather than a direct installer compromise.