MalwarePublished 5 Aug 2026

delivery-ci-microforms (npm) · Malicious Code

Affects delivery-ci-microformsSource GCVE Database

Malicious package : remove delivery-ci-microforms and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 16:24 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12676

What to do

Remove delivery-ci-microforms from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdelivery-ci-microforms	Affected =35.3.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package delivery-ci-microforms version 35.3.5 contains malicious code that auto-executes attacker-controlled binaries upon installation or require. It fetches opaque binaries from ephemeral Cloudflare Workers endpoints or DNS TXT records, writes them to temporary directories under deceptive names, sets executable permissions, and spawns them detached from the main process. The package uses obfuscation techniques to evade static detection and disguises the malicious activity under an 'analytics' cover story. This behavior results in arbitrary code execution on the installer's machine without explicit user consent.

Impact

Successful installation or requiring of this package results in arbitrary code execution on the affected system. The attacker-controlled binaries run detached and with executable permissions, potentially allowing full compromise of the host environment. The obfuscation and use of ephemeral hosting make detection and attribution more difficult. This poses a high risk to developers and systems that incorporate this package, as it can lead to unauthorized system access and control.

Defensive guidance

Users should immediately avoid installing or requiring delivery-ci-microforms version 35.3.5. Remove any existing installations of this package from projects and systems. Employ strict package source verification and use trusted package registries. Monitor for suspicious activity related to this package and consider using tools that detect malicious npm packages.

Summary

The delivery-ci-microforms npm package (version 35.3.5) includes malicious functionality that triggers automatically when the package is installed or required. The main module loads a support script that dynamically reconstructs platform-specific endpoints to fetch opaque binary payloads from multiple ephemeral Cloudflare Workers domains or via DNS TXT records. These binaries are saved to temporary directories with misleading filenames, made executable, and executed detached from the parent process using shell commands. The package further obfuscates its use of the child_process module by reconstructing its name at runtime and gates the malicious payload execution behind environment variable checks intended to appear as telemetry opt-outs. This design enables stealthy, attacker-controlled code execution on the victim's machine.

References

npmjs.com/package/delivery-ci-microforms/v/35.3.5 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 16:24 UTC

Technical details

References

Community reviews