MalwarePublished 15 Jul 2026

@debile/require-dir (npm) · Malicious Code

Affects @debile/require-dirSource GCVE Database

Malicious package : remove @debile/require-dir and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:50 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10654

What to do

Remove @debile/require-dir from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@debile/require-dir	Affected =1.9.1 =1.9.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @debile/require-dir is a typosquatted republishing of the popular require-dir package. Its package.json includes a preinstall script with a conditional curl command to an attacker-controlled server, currently disabled by an always-false condition. This setup allows an attacker to easily activate an install-time beacon for reconnaissance by modifying the condition. Versions 1.9.1 and 1.9.2 of @debile/require-dir are affected. No known exploits in the wild have been reported.

Impact

If the conditional guard in the preinstall script is modified or bypassed, the package could send network requests to an attacker-controlled server during installation. This could be used for reconnaissance or to confirm installation in victim environments. Currently, the curl command is disabled by an always-false condition, so no active network communication occurs. There are no reports of exploitation in the wild.

Defensive guidance

Users should avoid installing the @debile/require-dir package, especially versions 1.9.1 and 1.9.2. Verify dependencies carefully to avoid typosquatted or malicious packages. Monitor for updates from the package maintainer or npm advisories for remediation. Since the malicious code is gated behind a false condition, no immediate active exploitation occurs unless the code is modified.

Summary

The @debile/require-dir npm package republishes the code of the legitimate require-dir package under a different scope, effectively a typosquat. Its package.json preinstall script contains a bash command that conditionally executes a curl request to an attacker-controlled Interactsh (oast.fun) domain. The condition is currently always false ([[ 1 == 2 ]]), preventing actual network requests during installation. However, if the condition is altered to true, the package would send an install-time out-of-band beacon to the attacker, enabling reconnaissance or dependency confusion attacks. This behavior is present in versions 1.9.1 and 1.9.2 of the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 12:50 UTC

Technical details

References

Community reviews