MalwarePublished 30 Sep 2026Updated 8 Oct 2026

cdn-img-fetch (npm) · Malicious Code

Affects cdn-img-fetchSource GCVE Database

Malicious package : remove cdn-img-fetch and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:23 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17320

What to do

Remove cdn-img-fetch from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcdn-img-fetch	Affected =1.0.0 =1.0.1 =1.0.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package cdn-img-fetch versions 1.0.0 and 1.0.1 unconditionally downloads a file from a mutable third-party GitHub repository at module load time and writes it to a hidden temporary file on the installer's system. This behavior occurs automatically upon import without user interaction and does not verify the source content's integrity. The package's advertised functionality does not justify this import-time network fetch and hidden file write, indicating malicious intent as a first-stage dropper mechanism.

Impact

This vulnerability allows an attacker controlling the third-party GitHub repository to write arbitrary files into the temporary directory of any system importing the affected cdn-img-fetch package versions. This can lead to persistent unauthorized code or data being placed on the target system without user consent or awareness. While the current version does not execute the fetched file, the capability to write files at import time can facilitate subsequent stages of an attack, including code execution or system compromise.

Defensive guidance

Users should avoid using the cdn-img-fetch package versions 1.0.0 and 1.0.1. Since the package fetches and writes files automatically at import time from an untrusted source, removing or replacing this package with a trusted alternative is recommended. Monitor for updates from the package maintainer or vendor advisory for any official fixes or guidance.

Summary

The cdn-img-fetch npm package (versions 1.0.0 and 1.0.1) contains malicious code that, upon being required, immediately performs an HTTPS GET request to a mutable URL in a personal GitHub repository unrelated to the npm publisher. The response is saved to a hidden dot-file in the operating system's temporary directory via a temporary part file and rename operation. This fetch occurs automatically as an immediately invoked function expression (IIFE) during module load, without any user-triggered API call. The lack of version pinning, hash verification, or signature checks means the repository owner can control the exact bytes written to every installer's disk. Although the fetched file is not executed in the current package version, this mechanism provides an off-registry actor with a persistent import-time write primitive, enabling potential further malicious payload delivery.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Sep 2026, 16:39 UTC

Technical details

References

Community reviews