MalwarePublished 5 Aug 2026

certificates-revocation-utils (npm) · Malicious Code

Affects certificates-revocation-utilsSource GCVE Database

Malicious package : remove certificates-revocation-utils and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 15:47 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12539

What to do

Remove certificates-revocation-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcertificates-revocation-utils	Affected =35.1.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package certificates-revocation-utils version 35.1.9 contains malicious code that executes arbitrary attacker-controlled binaries on the installer's machine. Upon loading, it fetches a platform-specific binary from obfuscated Cloudflare Workers hostnames and a fallback domain, writes it to a temporary file, sets executable permissions, and runs it detached from the main process. This behavior is unrelated to the package's stated purpose and is hidden through code obfuscation. Installing or requiring this package results in remote code execution.

Impact

An attacker can execute arbitrary code on any system that installs or requires certificates-revocation-utils version 35.1.9. This leads to full compromise of the affected system, allowing the attacker to run any commands with the privileges of the user installing the package. The malicious payload is fetched from attacker-controlled infrastructure, making the attack remotely controlled and dynamic.

Defensive guidance

Users should immediately avoid installing or requiring certificates-revocation-utils version 35.1.9. Remove this package from any environments where it is present. Monitor for any unexpected binaries or processes spawned from npm package installations. Check vendor advisories or trusted security sources for updates or fixes. Since this is a malicious package, consider using package integrity verification and restricting installation of untrusted packages.

Summary

The certificates-revocation-utils npm package version 35.1.9 includes malicious functionality that, when the module is loaded, requires a vendor script which dynamically constructs Cloudflare Workers hostnames to download a platform-specific binary. If the primary method fails, it falls back to resolving DNS-TXT records from a suspicious domain. The downloaded binary is saved to a temporary path with a randomized filename, permissions are set to executable (chmod 0755 on POSIX), and it is executed in a detached process using shell commands. The code uses obfuscation techniques to hide the use of child_process and filesystem chmod calls. A temporary file is used to ensure the payload executes only once per time-to-live period. This results in arbitrary code execution on the machine installing or requiring this package.

References

npmjs.com/package/certificates-revocation-utils/v/35.1.9 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 15:47 UTC

Technical details

References

Community reviews