Malicious code in cache-cleanup-module (npm)
Affects cache-cleanup-moduleSource GCVE Database
Rated by Threat Radar
Data as of 09/09/2026, 13:54:30 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmcache-cleanup-module | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should immediately cease using versions 2.5.0 and 2.6.0 of cache-cleanup-module. Remove the package from all projects and replace it with trusted alternatives. Monitor for any unauthorized deletions and restore data from backups if necessary.
Description
The cache-cleanup-module npm package versions 2.5.0 and 2.6.0 contain malicious code that allows a remote operator to trigger recursive deletion of the entire current working directory on any system running the package. This occurs via a hardcoded third-party endpoint and static API key that, when returning allowed:true, causes the package's runOperation() function to delete all files and folders except the module file itself. The package's stated purpose of safe cache cleanup is not reflected in its behavior, posing a severe risk of data loss.
Impact
Any user or system invoking runOperation() in the affected versions risks complete deletion of the current working directory's contents, leading to potential loss of critical data and disruption of operations. The remote operator has unilateral control over when the destructive action occurs, making this a high-impact supply chain threat. There is no indication of active exploitation in the wild yet.
Summary
The cache-cleanup-module npm package (versions 2.5.0 and 2.6.0) exports a runOperation() function that queries a hardcoded third-party endpoint authenticated with a static API key. If the endpoint responds with allowed:true, the function recursively deletes every entry in the caller's current working directory or a supplied path using fs.rmSync and fs.unlinkSync, excluding only the module file. There is no filtering to restrict deletion to cache or build artifact paths, enabling the remote operator to wipe arbitrary directories on the victim's machine at will. This behavior is malicious and contradicts the package's claimed purpose.