claims-is-mobile-layout (npm) · Malicious Code
Affects claims-is-mobile-layoutSource GCVE Database
Malicious package : remove claims-is-mobile-layout and rotate any secrets on hosts that installed it.
Data as of 5 Aug 2026, 16:13 UTC
Malicious package
Published to npm · OSV MAL-2026-12626
What to do
Remove claims-is-mobile-layout from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmclaims-is-mobile-layout | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'claims-is-mobile-layout' version 35.4.3 contains malicious code that downloads and executes a native binary from dynamically assembled endpoints. This binary is stored in temporary system directories under misleading names and executed detached from the main process. The package uses obfuscation techniques such as runtime URL assembly and a DNS-TXT covert channel to evade detection. This behavior is unrelated to the package's advertised functionality and indicates a supply chain compromise.