Malicious code in certificates-revocation-sw (npm)
The npm package 'certificates-revocation-sw' version 35.6.4 contains malicious code that downloads and executes a platform-specific binary from obfuscated external hosts. Although it advertises itself as a certificate revocation provider, it lacks this functionality and instead acts as a remote code execution dropper. The malicious binary is fetched from Cloudflare Workers and fallback DNS-TXT records, saved under disguised filenames in temporary directories, given execute permissions, and launched detached from the main process. The package uses environment variables to gate execution and employs hostname obfuscation and misleading comments to evade detection.
AI Analysis
Technical Summary
The 'certificates-revocation-sw' npm package (version 35.6.4) includes an index.js that unconditionally loads a bootstrap script which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts and a DNS-TXT fallback. This binary is saved to temporary directories with disguised names, permissioned for execution, and spawned detached via shell commands. The package falsely advertises certificate revocation functionality but contains no such features. Instead, it acts as a remote code execution dropper, using environment variables to gate execution and obfuscation techniques to conceal its true behavior.
Potential Impact
This malicious package enables remote code execution on the host machine where it is installed, potentially allowing attackers to execute arbitrary code with the privileges of the user running the npm process. This can lead to system compromise, data theft, or further malware deployment. The deceptive nature of the package and its obfuscation techniques increase the risk of unnoticed compromise.
Mitigation Recommendations
No official patch or remediation is currently documented for this package. Users should immediately uninstall the 'certificates-revocation-sw' package version 35.6.4 and avoid installing it. Review systems for signs of compromise if this package was installed. Use trusted sources and verify package authenticity before installation. Monitor for updates from the package maintainer or npm security advisories for any official fixes or guidance.
Malicious code in certificates-revocation-sw (npm)
Description
The npm package 'certificates-revocation-sw' version 35.6.4 contains malicious code that downloads and executes a platform-specific binary from obfuscated external hosts. Although it advertises itself as a certificate revocation provider, it lacks this functionality and instead acts as a remote code execution dropper. The malicious binary is fetched from Cloudflare Workers and fallback DNS-TXT records, saved under disguised filenames in temporary directories, given execute permissions, and launched detached from the main process. The package uses environment variables to gate execution and employs hostname obfuscation and misleading comments to evade detection.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'certificates-revocation-sw' npm package (version 35.6.4) includes an index.js that unconditionally loads a bootstrap script which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts and a DNS-TXT fallback. This binary is saved to temporary directories with disguised names, permissioned for execution, and spawned detached via shell commands. The package falsely advertises certificate revocation functionality but contains no such features. Instead, it acts as a remote code execution dropper, using environment variables to gate execution and obfuscation techniques to conceal its true behavior.
Potential Impact
This malicious package enables remote code execution on the host machine where it is installed, potentially allowing attackers to execute arbitrary code with the privileges of the user running the npm process. This can lead to system compromise, data theft, or further malware deployment. The deceptive nature of the package and its obfuscation techniques increase the risk of unnoticed compromise.
Mitigation Recommendations
No official patch or remediation is currently documented for this package. Users should immediately uninstall the 'certificates-revocation-sw' package version 35.6.4 and avoid installing it. Review systems for signs of compromise if this package was installed. Use trusted sources and verify package authenticity before installation. Monitor for updates from the package maintainer or npm security advisories for any official fixes or guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12538
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a735731bf8831d53913cf60
Added to database: 08/05/2026, 15:30:57 UTC
Last enriched: 08/05/2026, 15:47:03 UTC
Last updated: 09/07/2026, 22:29:53 UTC
Views: 105
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.