crosswalker (npm) · Malicious Code
Affects crosswalkerSource GCVE Database
Rated by Threat Radar
Data as of 8 Sep 2026, 09:37 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
npmcrosswalkerpkg:npm/crosswalkerOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should avoid installing the affected versions (=1.0.0, =1.0.1, =18.2.1) of the crosswalker package. Monitor for updates or advisories from the package maintainers or npm security teams. Consider using package integrity verification tools and audit dependencies before installation.
Description
The crosswalker npm package versions 1.0.0, 1.0.1, and 18.2.1 contain malicious code that executes automatically during installation. The preinstall script runs index.js, which collects detailed system and user information and sends it to a hardcoded external URL. This behavior results in unauthorized data exfiltration from the host machine on every install.