MalwarePublished 15 Jun 2026Updated 1 Sep 2026

browserslist-db-sync (npm) · Malicious Code

Affects browserslist-db-syncSource GCVE Database

Malicious package : remove browserslist-db-sync and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 19:31 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5842

What to do

Remove browserslist-db-sync from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbrowserslist-db-sync	Affected =1.0.6 =1.0.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package browserslist-db-sync versions 1.0.4 and 1.0.6 contains malicious code that uses base64 decoding to potentially hide attacker-controlled payloads. Installation or execution of this package may lead to full system compromise, requiring immediate secret and key rotation. The package should be removed, but removal alone may not eliminate all malicious artifacts.

Impact

Systems with the affected versions of browserslist-db-sync installed or running are considered fully compromised. Attackers may have gained full control over the system, potentially exposing all stored secrets and keys. This level of compromise necessitates urgent security response actions to prevent further damage or data loss.

Defensive guidance

Remove the browserslist-db-sync package versions 1.0.4 and 1.0.6 immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Due to the potential for full system compromise, additional forensic analysis and remediation may be required beyond package removal.

Summary

The browserslist-db-sync npm package versions 1.0.4 and 1.0.6 include a suspicious use of Buffer.from(..., "base64").toString("utf8") in lib/mirror.js line 13, a pattern that can be used to obfuscate malicious payloads or credentials. Although the exact intent of the decoded data is not fully determined, the package is flagged as malicious by the GHSA-malware source, indicating that any system with this package installed should be considered fully compromised. Immediate remediation involves removing the package and rotating all secrets and keys from a separate, uncompromised system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 19:31 UTC

Technical details

References

Community reviews