MalwarePublished 24 Mar 2026Updated 1 Sep 2026

@ceeferenderer/fe-renderer-sdk (npm) · Malicious Code

Affects @ceeferenderer/fe-renderer-sdkSource GCVE Database

What to do

Affected software

Product	Affected	Fixed in
npm@ceeferenderer/fe-renderer-sdk	Affected =99.9.9 =9.9.0 =9.9.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @ceeferenderer/fe-renderer-sdk contains malicious code that executes both during installation and runtime. It uses obfuscated code to dynamically load modules and exfiltrate sensitive environment information such as the OS username, hostname, and current working directory via DNS queries to an attacker-controlled domain. The package's behavior includes silent error handling and evasion techniques, indicating clear malicious intent. Systems with this package installed should be considered fully compromised.

Impact

Any system with this package installed or running should be considered fully compromised. The package exfiltrates sensitive environment information to an attacker-controlled domain, potentially enabling further attacks. All secrets and keys stored on the compromised system should be rotated immediately from a separate, trusted system. Because the package executes code at install and runtime and may have granted attackers persistent access, removing the package alone may not restore system integrity.

Defensive guidance

Immediate removal of the @ceeferenderer/fe-renderer-sdk package is recommended. All credentials, secrets, and keys stored on the affected system should be rotated from a different, secure machine. Due to the high likelihood of full system compromise, a full system audit and potential rebuild from a known good backup are advised.

Summary

The @ceeferenderer/fe-renderer-sdk npm package runs malicious code at install time via an install script and at require time via its main module. It uses obfuscated helper modules to construct strings and dynamically load built-in Node.js modules to evade static analysis. The package assembles a unique subdomain containing the installer's OS username, hostname, current working directory basename, and a timestamp, then performs a DNS resolve4 lookup to exfiltrate this information to a domain controlled by attackers (oob.sl4x0.xyz). The combination of obfuscation, dynamic code execution, DNS-based data exfiltration, and silent error swallowing constitutes a credential reconnaissance beacon. Removal of the package does not guarantee system cleanup due to potential full system compromise.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Sep 2026, 04:23 UTC

Technical details

References

Community reviews