MalwarePublished 12 Aug 2026

cjdfswifuem3 (npm) · Malicious Code

Affects cjdfswifuem3Source GCVE Database

Malicious package : remove cjdfswifuem3 and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:50 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13793

What to do

Remove cjdfswifuem3 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcjdfswifuem3	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'cjdfswifuem3' version 1.0.0 is a malicious package that does not execute code upon installation but hosts an HTML page impersonating a Cloudflare Turnstile challenge. This page uses obfuscated JavaScript to redirect visitors to a phishing URL, abusing the npm registry as a distribution channel for phishing content rather than a supply-chain attack. The threat targets end users who access the hosted HTML via phishing links, not the package installers. There is no evidence of installer-side code execution or credential theft during installation.

Impact

There is no impact on users who install or import the package, as no code execution or credential access occurs during installation. The impact is on end users who visit the phishing page hosted by the package, potentially exposing them to phishing attacks via redirection to malicious URLs. The package itself does not compromise the installer's system. The ghsa-malware source's claim that any computer with this package installed should be considered fully compromised is inconsistent with the technical analysis and appears incorrect under the described threat model.

Defensive guidance

Since the package does not execute code on installation and targets end users via phishing links, the primary mitigation is to remove the package from the npm registry to prevent abuse as a phishing hosting platform. Users should avoid visiting URLs associated with this package. No action is required for developers who have installed the package but have not visited the hosted HTML page.

Summary

The 'cjdfswifuem3' npm package version 1.0.0 contains no executable JavaScript modules; its package.json points to an index.html file that cannot be required or imported. This HTML page simulates a Cloudflare Turnstile challenge and then executes obfuscated JavaScript to redirect visitors to a phishing URL, forwarding query parameters. The npm registry is abused solely as a hosting platform for this phishing lure page. No lifecycle scripts or importable code exist to compromise the installer. The threat is limited to end users who visit the phishing page, not to developers installing the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:50 UTC

Technical details

References

Community reviews