MalwarePublished 12 Aug 2026

dhjksficgwu2 (npm) · Malicious Code

Affects dhjksficgwu2Source GCVE Database

Malicious package : remove dhjksficgwu2 and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:48 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13802

What to do

Remove dhjksficgwu2 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdhjksficgwu2	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'dhjksficgwu2' version 1.0.0 contains a malicious HTML file impersonating a Cloudflare Turnstile verification page. This file includes obfuscated JavaScript that redirects users to a constructed URL based on query parameters. The package does not execute code upon installation or require, but its presence indicates phishing or redirect content hosted on npm. According to a malware source, any system with this package installed should be considered fully compromised, and all secrets and keys must be rotated immediately. Removal of the package alone may not eliminate all malicious software resulting from its installation.

Impact

Systems with this package installed should be considered fully compromised. The package facilitates phishing or redirect attacks, potentially exposing users to malicious sites. All secrets and keys stored on the compromised system should be rotated immediately from a secure environment. Removing the package does not guarantee removal of all malicious software that may have been installed as a result of this package.

Defensive guidance

Remove the 'dhjksficgwu2' package immediately from all affected systems. Rotate all secrets and keys stored on the compromised systems from a different, secure computer. Because the package presence indicates full system compromise, conduct a thorough investigation and remediation beyond just package removal. Patch status is not applicable as this is a malicious package rather than a vulnerability with a vendor fix.

Summary

The 'dhjksficgwu2' npm package version 1.0.0 contains a single index.html file declared as main, which impersonates a Cloudflare Turnstile 'Just a moment...' verification page. The HTML includes an inline script that reconstructs a redirect target from an obfuscated string array and URL query parameters, then redirects the browser to that URL. There is no executable JavaScript code running on install or require, making it a phishing or redirect artifact rather than a direct code exploit. However, the presence of this package on a system is considered a full compromise, as per the ghsa-malware source, recommending immediate secret rotation and package removal.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:48 UTC

Technical details

References

Community reviews