MalwarePublished 12 Aug 2026

cvbmxiowkwqla6 (npm) · Malicious Code

Affects cvbmxiowkwqla6Source GCVE Database

Malicious package : remove cvbmxiowkwqla6 and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:50 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13796

What to do

Remove cvbmxiowkwqla6 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcvbmxiowkwqla6	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package cvbmxiowkwqla6 version 1.0.0 is identified as malicious. Although analysis found no typical supply-chain attack behaviors such as lifecycle scripts or network calls, the package is considered fully compromising to any system where it is installed. Immediate removal is advised, and all secrets and keys on the affected system should be rotated from a different, trusted machine. There is no guarantee that removing the package will eliminate all malicious components due to potential full system compromise.

Impact

Installation of cvbmxiowkwqla6@1.0.0 results in a fully compromised system, potentially exposing all stored secrets and keys. The compromise is severe enough that simply removing the package may not restore system integrity, implying possible persistent or additional malicious components.

Defensive guidance

Remove the cvbmxiowkwqla6@1.0.0 package immediately. Rotate all secrets and keys stored on the compromised system from a different, trusted computer. Due to the potential for full system compromise, further forensic analysis and remediation may be necessary to ensure complete removal of malicious software.

Summary

The npm package cvbmxiowkwqla6@1.0.0 contains only two files and lacks behaviors commonly associated with supply-chain attacks, such as lifecycle scripts, network communications, credential access, or code execution primitives. Despite this, security sources classify the package as malicious, stating that any computer with this package installed should be considered fully compromised. The package name appears to be a random string, consistent with placeholder or throwaway publications. The advisory recommends immediate removal and rotation of all secrets and keys from a separate trusted system, noting that removal may not fully eradicate malicious software introduced by the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:50 UTC

Technical details

References

Community reviews