claims-fixtures-shared (npm) · Malicious Code
Affects claims-fixtures-sharedSource GCVE Database
Malicious package : remove claims-fixtures-shared and rotate any secrets on hosts that installed it.
Data as of 5 Aug 2026, 16:09 UTC
Malicious package
Published to npm · OSV MAL-2026-12615
What to do
Remove claims-fixtures-shared from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmclaims-fixtures-shared | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'claims-fixtures-shared' version 35.8.6 contains malicious code that downloads and executes an attacker-controlled binary. The code reconstructs obfuscated Cloudflare Workers hostnames and DNS TXT resolvers to evade detection, downloads a binary without verifying its integrity, writes it to temporary storage, sets executable permissions, and runs it detached. The package masquerades as a harmless fixtures helper but actually stages and executes arbitrary payloads. No official patch or remediation guidance is provided.