MalwarePublished 12 Aug 2026

csbcldfvivwfgd4 (npm) · Malicious Code

Affects csbcldfvivwfgd4Source GCVE Database

Malicious package : remove csbcldfvivwfgd4 and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:50 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13795

What to do

Remove csbcldfvivwfgd4 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcsbcldfvivwfgd4	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package csbcldfvivwfgd4 version 1.0.0 contains a malicious index.html file that mimics a Cloudflare challenge page and includes obfuscated JavaScript which redirects browser users to a potentially harmful URL. This malicious behavior only triggers when the HTML is rendered in a browser via an npm-backed CDN, not during installation or import in a Node.js environment. There is no code execution or credential theft on the installer's machine, but the package is abused as a phishing or malvertising redirect hosted on the npm registry.

Impact

The malicious package does not execute harmful code during installation or import in Node.js environments, so developers installing or requiring it are not directly compromised. The impact is on browser users who access the package's HTML via npm-backed CDNs, where the obfuscated JavaScript redirects them to potentially malicious sites, enabling phishing or malvertising attacks. There is no evidence of direct code execution, credential theft, or persistence on the installer's machine. The conflicting claim that systems with the package installed are fully compromised is not supported by the technical details describing the attack vector as browser-based only.

Defensive guidance

Since the malicious behavior only occurs when the package's HTML is rendered in a browser via npm-backed CDNs, developers installing or requiring the package in Node.js environments are not at risk. Users should avoid accessing this package via CDN URLs in browsers. The package version 1.0.0 should be removed from projects if present. Secret rotation is recommended only if there is evidence of compromise beyond the described browser redirect behavior, but this is not confirmed by the vendor advisory. Monitor for and block access to the package's CDN URLs to prevent browser-based exploitation.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:50 UTC

Technical details

References

Community reviews