cardsmobile-event-emitter (npm) · Malicious Code
Affects cardsmobile-event-emitterSource GCVE Database
Malicious package : remove cardsmobile-event-emitter and rotate any secrets on hosts that installed it.
Data as of 5 Aug 2026, 15:49 UTC
Malicious package
Published to npm · OSV MAL-2026-12532
What to do
Remove cardsmobile-event-emitter from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmcardsmobile-event-emitter | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package cardsmobile-event-emitter (version 35.2.8) contains malicious code that, upon requiring the package, downloads and executes an opaque platform-specific binary from multiple Cloudflare Workers hosts and fallback DNS TXT channels. This binary is saved to temporary directories with disguised filenames and executed detached from the main process. The package's stated functionality as an event emitter is unrelated to this behavior, and there is no integrity verification of the downloaded binary. A second copy of the dropper with similar behavior is also included in the package tarball.