MalwarePublished 14 Aug 2026

@cdnshell/loader (npm) · Malicious Code

Affects @cdnshell/loaderSource GCVE Database

Malicious package : remove @cdnshell/loader and rotate any secrets on hosts that installed it.

Data as of 14 Aug 2026, 16:44 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-14039

What to do

Remove @cdnshell/loader from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@cdnshell/loader	Affected 0.0.13 – 0.0.20 7 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @cdnshell/loader npm package masquerades as a CDN static-asset distribution library but contains 19 pre-compiled Mach-O binaries targeting iOS versions 13 to 19. These binaries reference private iOS entitlements and WebKit GPU-process IPC symbols consistent with a WebKit renderer-to-kernel exploit chain. The package includes an obfuscated JavaScript loader that dynamically fetches and executes remote code, selecting payload variants based on the visitor's user agent. The malicious behavior activates only when the loader is embedded in a webpage served to iOS/macOS users, enabling targeted exploitation. There are no npm lifecycle hooks or main entry points, so the package does not execute on installation or require, making detection harder. This combination of obfuscation, multi-version exploit payloads, and dynamic remote code execution is inconsistent with legitimate static asset distribution libraries.

Impact

Devices running iOS versions 13 through 19 and macOS that visit webpages embedding this loader may be targeted by a WebKit exploit chain capable of executing code with elevated privileges. The exploit leverages private entitlements and kernel-level primitives, potentially allowing attackers to escalate privileges and execute arbitrary code on the device. The malicious code is not triggered by npm install or require, reducing detection during development but posing a significant risk to end users exposed via web content. There is no evidence of active exploitation in the wild at this time.

Defensive guidance

Since the package does not execute on npm install or require, avoid embedding or serving the @cdnshell/loader package in any web content, especially to iOS/macOS users. Monitor and audit dependencies for this package and remove any usage immediately. Check vendor advisories or npm security notices for updates or removal actions.

Summary

The @cdnshell/loader npm package is a malicious library that delivers a multi-stage exploit targeting iOS/macOS devices via WebKit vulnerabilities. It ships with 19 pre-compiled Mach-O binaries for various iOS versions, including variants for a64e/PAC architectures, referencing private entitlements and IPC symbols indicative of a renderer-to-kernel exploit chain. The JavaScript entrypoint is heavily obfuscated and dynamically fetches and executes remote modules based on the visitor's platform, enabling remote code execution. The package does not execute during npm install or require, activating only when embedded in web content served to targeted devices. This behavior and payload set strongly indicate a sophisticated supply chain attack vector designed to compromise iOS/macOS users through malicious web content.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 16:44 UTC

Technical details

References

Community reviews