MalwarePublished 17 Jun 2026Updated 15 Jul 2026

canary-ci-test (npm) · Malicious Code

Affects canary-ci-testSource GCVE Database

Malicious package : remove canary-ci-test and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:55 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5972

What to do

Remove canary-ci-test from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcanary-ci-test	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'canary-ci-test' version 1.0.0 contains malicious code that executes during installation. Its postinstall script collects host identifiers such as hostname, username, current working directory, platform, and DNS resolution results, then silently sends this data to a hardcoded external URL without user consent. This behavior is unrelated to the package's declared purpose and constitutes install-time data exfiltration. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated. Removal of the package does not guarantee full remediation due to potential further compromise.

Impact

The malicious postinstall script exfiltrates sensitive host identifiers to an external server without user consent or awareness. This compromises the confidentiality of the affected system's environment. According to the source advisory, any computer with this package installed or running should be considered fully compromised, implying potential unauthorized control or further malicious activity. All secrets and keys stored on the compromised machine should be rotated immediately from a separate, trusted system. Removing the package alone may not fully remediate the compromise due to possible additional malware installed.

Defensive guidance

The recommended mitigation is to immediately remove the 'canary-ci-test' package version 1.0.0 from all affected systems. Treat any system with this package installed as fully compromised. Rotate all secrets, credentials, and keys stored on the affected systems from a different, secure machine. Conduct a thorough security assessment to identify and remediate any additional malicious software or backdoors that may have been installed. Monitor for any suspicious activity related to this compromise.

Summary

The 'canary-ci-test' npm package version 1.0.0 includes a postinstall lifecycle script that collects sensitive host information (os.hostname(), os.userInfo().username, process.cwd(), platform, DNS resolution) and sends it as JSON via an HTTPS POST request to a hardcoded endpoint (https://opgelost.nu/). This exfiltration occurs automatically during installation with no user opt-in and no visible indication, matching a classic install-time phone-home malicious pattern. The package metadata claims it is a scanner test fixture, but the actual code performs functional data exfiltration against any machine installing it. The compromise is severe enough that any machine with this package installed should be treated as fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 12:55 UTC

Technical details

References

Community reviews