MalwarePublished 9 Jun 2026Updated 1 Sep 2026

corporate-front-vue (npm) · Malicious Code

Affects corporate-front-vueSource GCVE Database

Malicious package : remove corporate-front-vue and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 18:47 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5438

What to do

Remove corporate-front-vue from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcorporate-front-vue	Affected =99.9.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package corporate-front-vue@99.9.1 is a malicious package designed to perform dependency confusion by referencing a tarball hosted outside the npm registry. Installing this package causes npm to fetch and execute code from an attacker-controlled Google Cloud Storage URL, potentially compromising the host system. The package itself is a near-empty shim that exists solely to load this external malicious payload. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately. Removal of the package does not guarantee full remediation due to the potential for persistent malicious code.

Impact

Systems that install corporate-front-vue@99.9.1 are fully compromised, as the package executes attacker-controlled code during installation. This can lead to unauthorized access, data exfiltration, and persistent malicious presence. All secrets and keys stored on the compromised system should be considered exposed and must be rotated from a secure environment. Simply removing the package does not guarantee removal of all malicious artifacts.

Defensive guidance

Remove the corporate-front-vue@99.9.1 package immediately from all affected systems. Rotate all secrets and keys that were stored or accessible on compromised machines from a different, secure system. Due to the potential for persistent compromise, consider full system reimaging or forensic analysis to ensure complete remediation. Monitor for any suspicious activity related to this package installation. Patch status is not applicable as this is a malicious package rather than a software vulnerability with an official fix.

Summary

The corporate-front-vue package at version 99.9.1 is a malicious npm package that acts as a loader for an attacker-controlled tarball hosted on Google Cloud Storage. This tarball is fetched and installed during npm install, bypassing npm registry review and allowing execution of arbitrary code on the installer's machine. The package metadata and versioning indicate a dependency confusion attack pattern, aiming to supersede legitimate internal packages. The package exports an empty object and serves only to trigger installation of the malicious payload. This results in full compromise of any affected system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 18:47 UTC

Technical details

References

Community reviews