MalwarePublished 20 May 2026Updated 1 Sep 2026

bolt-delivery-menu-app (npm) · Malicious Code

Affects bolt-delivery-menu-appSource GCVE Database

What to do

Affected software

Product	Affected	Fixed in
npmbolt-delivery-menu-app	Affected =9.9.11	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'bolt-delivery-menu-app' version 9.9.11 contains malicious code that executes a DNS-based beacon both at install time and on every module require. It collects host identity information such as username, hostname, and current working directory, then exfiltrates this data via DNS queries to an attacker-controlled domain. The package impersonates the Bolt delivery brand and falsely claims no network activity in its README. Installation of this package compromises the host, potentially exposing all stored secrets and keys.

Impact

Any system with this package installed or running is considered fully compromised. The attacker gains access to host identity information and potentially full control over the system. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately. Removing the package alone may not eliminate all malicious components or backdoors introduced by the attacker.

Defensive guidance

The recommended mitigation is immediate removal of the 'bolt-delivery-menu-app' package version 9.9.11 from all affected systems. Additionally, all secrets, credentials, and keys stored on compromised systems should be rotated from a separate, trusted environment. Due to the potential full compromise, consider rebuilding affected systems to ensure complete remediation.

Summary

The 'bolt-delivery-menu-app' npm package (version 9.9.11) is a malicious package that performs DNS-based data exfiltration. Upon installation and each require call, it runs code that reads the operating system username, hostname, and current working directory, concatenates these with a campaign tag, and sends the information via DNS resolve4 queries to the attacker's domain 'oob.sl4x0.xyz'. The package uses obfuscation techniques by storing critical strings as character code arrays to evade detection by string-grep scanners. The package name and author email are part of a typosquatting campaign designed to impersonate a legitimate brand and lure victims. The README falsely claims no network requests are made, misleading users about its behavior. This results in a full compromise of any system where the package is installed.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Sep 2026, 08:38 UTC

Technical details

References

Community reviews