MalwarePublished 5 Aug 2026

caen-caen-core (npm) · Malicious Code

Affects caen-caen-coreSource GCVE Database

Malicious package : remove caen-caen-core and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 15:46 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12520

What to do

Remove caen-caen-core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcaen-caen-core	Affected =35.5.8	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package caen-caen-core version 35.5.8 contains malicious code that downloads and executes OS-specific native binaries from hardcoded, obfuscated Cloudflare Workers hosts and fallback DNS-TXT domains. These binaries are saved under deceptive filenames in temporary directories, given executable permissions, and run detached without any integrity verification. The package uses obfuscation techniques to evade static analysis and disguises its behavior under a telemetry/analytics pretense. This allows an attacker controlling the command-and-control infrastructure to execute arbitrary code on any machine that installs or requires this package.

Impact

An attacker controlling the command-and-control infrastructure can achieve arbitrary code execution on any machine that installs or requires the affected version of the caen-caen-core package. This can lead to full system compromise, data theft, or further malware deployment. The lack of integrity checks on downloaded binaries and the use of obfuscation increase the risk and difficulty of detection.

Defensive guidance

Users should immediately stop using caen-caen-core version 35.5.8 and remove it from their environments. Avoid installing or requiring this package until a trusted, verified version is available. Monitor for any unusual processes spawned from temporary directories with deceptive names. Verify package integrity and source before installation.

Summary

The caen-caen-core npm package (version 35.5.8) includes a malicious payload in its main entry point (index.js) and a secondary dropper in lib/telemetry.js. Upon require, it downloads OS-specific native binaries from obfuscated Cloudflare Workers URLs and fallback DNS-TXT base64-encoded addresses, writes them to temporary directories with deceptive names, sets executable permissions, and spawns them detached via shell commands. No hash or signature verification is performed on the downloaded binaries. Hostnames are dynamically reconstructed to evade static detection. The package falsely claims to provide telemetry functionality, which is used as a cover story. This behavior enables arbitrary code execution controlled by the attacker on any system using this package.

References

npmjs.com/package/caen-caen-core/v/35.5.8 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 15:46 UTC

Technical details

References

Community reviews