MalwarePublished 9 Jul 2026Updated 1 Sep 2026

conversionvaluemanager (npm) · Malicious Code

Affects conversionvaluemanagerSource GCVE Database

Malicious package : remove conversionvaluemanager and rotate any secrets on hosts that installed it.

Data as of 17 Sep 2026, 20:49 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10084

What to do

Remove conversionvaluemanager from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmconversionvaluemanager	Affected =3.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'conversionvaluemanager' version 3.0.0 contains malicious code that executes during installation. Its postinstall.js script collects host and environment information and sends it via an unencrypted HTTP GET request to an external third-party server. The package is framed as a dependency confusion proof-of-concept but leaks sensitive installer data on every install.

Impact

Organizations that inadvertently install this package version 3.0.0 risk leaking sensitive host and environment information, including hostname, user details, platform, working directory, and Node.js version, to an external third-party server. This information disclosure could aid attackers in profiling the environment for further attacks or reconnaissance. There is no indication of remote code execution or direct system compromise beyond data leakage. No known exploits in the wild have been reported.

Defensive guidance

Users should avoid installing 'conversionvaluemanager' version 3.0.0 from public npm repositories, especially if their build processes could mistakenly resolve internal package names to this public package. Review and enforce strict package resolution policies to prevent dependency confusion. Monitor and audit package dependencies to detect and exclude malicious or unintended packages.

Summary

The 'conversionvaluemanager' npm package version 3.0.0 includes a postinstall.js script that automatically runs upon installation. This script gathers data such as the hostname, user information, platform, current working directory, Node.js version, and timestamp. It then transmits this information as query parameters over plain HTTP to a Burp Collaborator subdomain controlled by a third party. The package is labeled as a dependency confusion proof-of-concept and targets internal or private package names, causing organizations that mistakenly resolve to this public package to leak environment identifiers to an external endpoint. Although presented as a PoC or bug bounty demonstration, the data leakage occurs on every installation, posing a privacy and security risk.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 17 Sep 2026, 20:49 UTC

Technical details

References

Community reviews