MalwarePublished 9 Jul 2026

chunk-parser (npm) · Malicious Code

Affects chunk-parserSource GCVE Database

Malicious package : remove chunk-parser and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 10:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10057

What to do

Remove chunk-parser from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmchunk-parser	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'chunk-parser' version 1.0.0 contains malicious code acting as a remote-access trojan under the internal name 'runtimedev-link'. It downloads a portable Node.js runtime and installs persistent backdoors across Linux, macOS, and Windows systems. The trojan communicates with an operator-controlled API to execute shell commands, exfiltrate files, and report system and browser extension data. It maintains persistence by reinstalling itself at every system startup via multiple platform-specific mechanisms. This package poses a significant risk of unauthorized remote control and data theft.

Impact

This malicious package enables an attacker to gain persistent remote access to affected systems, execute arbitrary shell commands, and exfiltrate sensitive files and system information. The trojan collects detailed telemetry including user environment and browser extension data, potentially exposing user privacy and security. The live auto-update mechanism allows the attacker to modify payloads dynamically, increasing the threat's adaptability and risk. Systems running this package version are fully compromised while the trojan remains active.

Defensive guidance

Users should immediately uninstall 'chunk-parser' version 1.0.0 and remove all persistence mechanisms related to 'runtimedev-link' manually. Avoid installing or using this package from npm. Monitor for and delete any scheduled tasks, systemd units, LaunchAgents, or cron jobs named or related to 'runtimedev-link'. Since this is a malicious package, remediation involves removal and system cleanup rather than patching. Verify system integrity and consider incident response procedures to address potential compromise.

Summary

The 'chunk-parser' npm package version 1.0.0 masquerades as a legitimate Node.js chunk parser but contains a full remote-access trojan identified internally as 'runtimedev-link'. It downloads a portable Node.js 22.22.0 runtime to the user's local directory and runs a bundled agent CLI separate from the system Node.js. Persistence is established via Linux systemd user units, cron jobs, macOS LaunchAgents, and Windows Task Scheduler tasks, all configured to reinstall and auto-update the trojan at each boot/login. The trojan polls an operator-controlled API to receive shell commands, executes them, and returns output. It can exfiltrate arbitrary files up to 50MB by zipping and uploading them encoded to the operator. Additionally, it continuously reports host details, user information, public IP, home directory structure, and browser extension inventories to the attacker. This creates a persistent, stealthy backdoor with live auto-update capability.

References

npmjs.com/package/chunk-parser/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 10:15 UTC

Technical details

References

Community reviews