briantreehttp (npm) · Malicious Code
Affects briantreehttpSource GCVE Database
Malicious package : remove briantreehttp and rotate any secrets on hosts that installed it.
Data as of 27 Oct 2026, 00:07 UTC
Malicious package
Published to npm · OSV MAL-2026-3639
What to do
Remove briantreehttp from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmbriantreehttp | Affected– | Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
`briantreehttp` is a typosquatting package impersonating `braintreehttp`, the HTTP client library published by Braintree/PayPal. The package bundles the legitimate library source to appear functional while hiding a credential-theft payload in `index1.js`, which is executed at install time via the `postinstall` script. The payload collects hostname, platform, architecture, Node.js version, UID, current working directory, all environment variables, AWS credentials (`~/.aws/credentials`, `~/.aws/config`), npm tokens from `.npmrc` files (root, home, and working directory), Docker config (`~/.docker/config.json`), git config, `.netrc`, yarn config, npm global config, directory listings of the working directory, home, filesystem root, and `/etc`, network configuration files (`/etc/resolv.conf`, `/etc/hosts`, `/proc/net/route`), and AWS ECS/EC2 instance metadata from internal endpoints. All collected data is base64-encoded and exfiltrated via HTTPS POST to `reportviewer.click/collect/`. A secondary DNS-based exfiltration channel encodes environment variables into a subdomain and issues a request to `dns.reportviewer.click`.