MalwarePublished 30 Jun 2026

cursed-modules (npm) · Malicious Code

Affects cursed-modulesSource GCVE Database

Malicious package : remove cursed-modules and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:55 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6698

What to do

Remove cursed-modules from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcursed-modules	Affected 1.0.1 – 999.1.2 19 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The 'cursed-modules' npm package versions 2.0.0 and 999.0.0 through 999.0.3 contain malicious code designed to steal credentials and sensitive environment data. The package uses lifecycle hooks to execute install-time scripts that collect SSH keys, npm configuration, git history, environment variables, and AWS credentials, exfiltrating them to attacker-controlled endpoints. The malicious payload activates only inside containerized CI/CD environments, evading detection on typical developer machines. This is a dependency confusion attack targeting internal package names to harvest private registry credentials and enable further attacks.

Impact

Successful installation or inclusion of this package in a containerized CI/CD environment results in theft of sensitive credentials including SSH keys, npm and git configuration, environment variables, and AWS credentials. This can lead to unauthorized access to internal systems, private registries, and cloud resources. The attack is stealthy, activating only in container environments, which increases the risk of undetected compromise in automated build and deployment pipelines.

Defensive guidance

Until then, avoid using the 'cursed-modules' package, especially versions 2.0.0 and 999.0.0 through 999.0.3. Implement strict controls on package sources and verify package authenticity to prevent dependency confusion attacks. Monitor for and remove any instances of this package in your environments.

Summary

The 'cursed-modules' npm package (versions 2.0.0 and 999.0.0 to 999.0.3) is a malicious package that performs credential theft through install-time and require-time scripts. It collects sensitive files such as SSH private keys, npm and git configuration files, environment variables, and AWS credentials by querying the AWS instance metadata service and AWS Secrets Manager. The stolen data is exfiltrated via HTTP PUT requests to hardcoded attacker IP addresses. Execution is gated to trigger only when the hostname matches a Docker container ID pattern, targeting containerized CI/CD environments and avoiding detection in other environments. The package also attempts to harvest private npm registry credentials by reading Verdaccio configuration and htpasswd files. This package is part of a dependency confusion attack designed to shadow internal package names on the public npm registry and facilitate follow-on attacks.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Jun 2026, 23:39 UTC

Technical details

References

Community reviews