MalwarePublished 14 Apr 2026Updated 1 Sep 2026

buffer-util-extend (npm) · Malicious Code

Affects buffer-util-extendSource GCVE Database

What to do

Affected software

Product	Affected	Fixed in
npmbuffer-util-extend	Affected =1.0.8 =1.0.13 =1.0.11 =1.0.2 =1.0.3 =1.0.4 =1.0.5 =1.0.6 =1.0.7 =1.0.9 =1.0.10 =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The 'buffer-util-extend' npm package contains malicious code that executes arbitrary JavaScript fetched from a remote, mutable JSON paste URL during import. This results in full arbitrary code execution on the machine installing or building with the package. The package impersonates the legitimate 'buffer' package to deceive users, adding unrelated dependencies and a remote eval payload. Any system with this package installed should be considered fully compromised, and secrets should be rotated immediately. Removal of the package does not guarantee full remediation due to potential persistence of malicious software.

Impact

Any computer that installs or runs this package is fully compromised due to arbitrary code execution at import time. Attackers can execute any code on the affected system, potentially stealing secrets, installing persistent malware, or performing other malicious actions. Secrets and keys stored on the compromised system should be considered exposed and rotated immediately from a secure environment. Removing the package alone may not remove all malicious artifacts or backdoors introduced by the attacker.

Defensive guidance

Immediate removal of the 'buffer-util-extend' package is required. All secrets and keys on affected systems must be rotated from a different, trusted machine. Because the package executes remote code dynamically, full system compromise is likely; therefore, a thorough incident response and system rebuild may be necessary. Avoid using this package and verify dependencies carefully to prevent supply-chain attacks.

Summary

The 'buffer-util-extend' npm package versions 1.0.1 through 1.0.13 (including 1.0.8, 1.0.11, and others) contain a supply-chain attack where the package's index.js decodes a base64-encoded URL pointing to a mutable JSON paste. It fetches this JSON and executes the 'content' field via eval(), allowing an attacker to run arbitrary code on the install/build machine at import time. The package mimics the legitimate 'buffer' package by copying its metadata and source code but adds malicious dependencies and the remote code execution payload. This design enables attackers to swap payloads at any time without republishing the package, posing a severe risk to any system that installs or uses it.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Sep 2026, 09:22 UTC

Technical details

References

Community reviews