MalwarePublished 5 Aug 2026Updated 20 Aug 2026

digital-interview-digital-interview-core (npm) · Malicious Code

Affects digital-interview-digital-interview-coreSource GCVE Database

Malicious package : remove digital-interview-digital-interview-core and rotate any secrets on hosts that installed it.

Data as of 20 Aug 2026, 16:58 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12362

What to do

Remove digital-interview-digital-interview-core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdigital-interview-digital-interview-core	Affected =20.5.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package digital-interview-digital-interview-core version 20.5.3 contains malicious code that downloads and executes arbitrary binaries from obfuscated external hosts without verification. This behavior results in arbitrary remote code execution on the host machine at load time. The malicious payload masquerades as legitimate telemetry files and evades static analysis through string obfuscation. Systems with this package installed should be considered fully compromised, and all secrets on those systems should be rotated immediately.

Impact

Systems with this package installed are subject to arbitrary remote code execution, effectively allowing an attacker full control over the compromised host. All secrets and credentials stored on the affected system are at risk and should be considered compromised. The malicious code executes immediately upon package load, making the threat immediate and severe.

Defensive guidance

Immediate removal of the package is recommended. However, since the package grants full control to an attacker, affected systems should be treated as fully compromised. All secrets and keys stored on the system must be rotated from a different, trusted machine. Comprehensive system audits and potential rebuilds may be necessary to ensure complete remediation.

Summary

The digital-interview-digital-interview-core npm package version 20.5.3 includes a malicious _helpers.js script that, upon require(), downloads platform-specific binaries from Cloudflare workers.dev hosts and fallback domains using obfuscated hostnames and string-splitting techniques. The downloaded binaries are saved under disguised filenames in temporary directories, made executable, and executed detached via shell commands without any hash or signature verification. This results in arbitrary remote code execution on the installer's host at load time. The malicious behavior is gated by environment variable checks and run-once markers to evade detection. The package is not from the legitimate publisher, and the compromise is severe enough that removal of the package alone does not guarantee system cleanup.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 20 Aug 2026, 16:58 UTC

Technical details

References

Community reviews