MalwarePublished 20 May 2026Updated 1 Sep 2026

color-style-utils (npm) · Malicious Code

Affects color-style-utilsSource GCVE Database

Malicious package : remove color-style-utils and rotate any secrets on hosts that installed it.

Data as of 8 Sep 2026, 09:37 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-4534

What to do

Remove color-style-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcolor-style-utils	Affected =1.0.9 =1.0.8 =1.0.3 =1.0.7 =1.0.4 =1.0.5 =1.0.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package color-style-utils contains malicious code that executes during installation lifecycle hooks. The postinstall.js script harvests sensitive credentials and configuration files from the host, including SSH keys, cloud service credentials, crypto wallets, and tokens for various services. It also collects detailed host fingerprinting information and exfiltrates all gathered data to an attacker-controlled server. The package exhibits suspicious behaviors such as a self-referential dependency and shipping an undeclared file with a non-ASCII suffix, consistent with name-squatting and decoy tactics.

Impact

This malicious package can lead to severe credential compromise across multiple cloud and service platforms, exposure of sensitive user and system configuration data, and potential unauthorized access to cloud resources, developer accounts, and cryptographic assets. The exfiltration of environment variables and tokens can facilitate further attacks or persistent access. Host fingerprinting enables targeted follow-up attacks. The presence of undeclared files and self-dependencies complicates detection and removal.

Defensive guidance

Users should avoid installing color-style-utils versions 1.0.3 through 1.0.9. Remove any installations of this package immediately and rotate any potentially compromised credentials and tokens. Monitor for suspicious network activity related to the exfiltration endpoints described. Use trusted sources and verify package integrity before installation. Check vendor advisories or npm security advisories for updates or removal notices.

Summary

The color-style-utils npm package versions 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, and 1.0.9 contain malicious code executed during all three lifecycle hooks (preinstall, install, postinstall). The postinstall.js script collects a wide range of sensitive data from the host environment, including SSH keys, AWS, Google Cloud, Azure credentials, npm configuration, Kubernetes, Docker configs, browser profiles, crypto wallets, VPN configs, shell histories, environment variables, and tokens for GitHub, AWS, Google, Stripe, Slack, and Discord. It also fingerprints the host's network and user environment and sends this data to a remote attacker-controlled endpoint via HTTPS. The package also declares a self-dependency and includes an undeclared sibling file with a non-standard filename, indicative of malicious name-squatting and decoy smuggling techniques.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Sep 2026, 09:37 UTC

Technical details

References

Community reviews