MalwarePublished 12 Aug 2026

cxcbdjxcmncvfg2 (npm) · Malicious Code

Affects cxcbdjxcmncvfg2Source GCVE Database

Malicious package : remove cxcbdjxcmncvfg2 and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:48 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13801

What to do

Remove cxcbdjxcmncvfg2 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcxcbdjxcmncvfg2	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package cxcbdjxcmncvfg2 version 1.0.0 contains malicious code that impersonates a Cloudflare challenge page to redirect users to an attacker-controlled domain. The package is designed solely to serve a browser-side phishing landing page and does not include any legitimate JavaScript modules or lifecycle scripts. Installation or execution of this package may lead to full compromise of the affected system, requiring immediate secret and key rotation from a separate device.

Impact

Systems that have this package installed or running may be fully compromised, as the package facilitates phishing by redirecting users to an attacker-controlled domain. This can lead to credential theft or further compromise. The presence of this package indicates a high risk to secrets and keys stored on the affected system, necessitating immediate rotation of all such credentials from a secure environment.

Defensive guidance

Remove the malicious package immediately. Rotate all secrets and keys stored on the affected system from a separate, secure computer. Because the package may have given attackers full control over the system, removing the package alone does not guarantee complete remediation. Conduct a thorough security assessment and consider rebuilding the affected system if compromise is suspected.

Summary

The npm package cxcbdjxcmncvfg2 version 1.0.0 includes a single index.html file that visually mimics a Cloudflare 'Just a moment...' challenge page, including spoofed elements such as a Ray ID and meta tags to avoid indexing. After a short delay, obfuscated JavaScript reconstructs a URL pointing to an attacker-controlled domain (gin.microcloud.homes) and redirects the browser there, propagating all query parameters. This domain is not affiliated with Cloudflare, and the package has no legitimate JavaScript main file, lifecycle scripts, or importable modules. Its sole purpose is to abuse the npm registry as a distribution channel for a phishing landing page. According to the source, any system with this package installed or running should be considered fully compromised, with immediate secret and key rotation recommended from a different computer.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:48 UTC

Technical details

References

Community reviews