MalwarePublished 10 Jul 2026

driftpin (npm) · Malicious Code

Affects driftpinSource GCVE Database

Malicious package : remove driftpin and rotate any secrets on hosts that installed it.

Data as of 11 Jul 2026, 09:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10114

What to do

Remove driftpin from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdriftpin	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (bb2b2601b0e4e6659a7fd042e4f227e3d22880c51355a793dbdc2e42d39805d5) driftpin@1.0.0 advertises itself in the README as an SVG sanitization/minification/conversion utility, but the only actual export from index.js is an undocumented function `getPlugin`. When a consumer calls `getPlugin()()`, the returned closure performs an HTTP GET against https://www.jsonkeeper.com/b/3P9BF — an anonymous, mutable paste host — parses the JSON response, and passes the response's `model` field directly to `eval`. Whoever controls the paste can change its contents at any moment to run arbitrary JavaScript inside any process that loads driftpin and invokes the export. The advertised SVG functionality is a cover story; the documented API surface (sanitizeSVG/minifySVG/saveSVG/convertSVGToPNG) is not actually exported. Additionally, index.js `require('request')` without declaring `request` in package.json dependencies, indicating the backdoor was grafted onto an unrelated skeleton.

Impact

This vulnerability enables remote code execution in any environment that installs driftpin@1.0.0 and invokes its exported function. Because the malicious code fetches and evaluates attacker-controlled scripts dynamically, the attacker can execute arbitrary commands, potentially compromising the host system or application. The impact is severe due to the ability to run arbitrary code with the privileges of the affected process.

Defensive guidance

Users and organizations should avoid installing or using this package. If already installed, remove it immediately from all environments and replace it with trusted alternatives. Monitor dependency trees to detect and exclude this malicious package. Since this is a malicious package, no legitimate fix exists; the best mitigation is to not use it.

Summary

driftpin@1.0.0 is a malicious npm package that masquerades as an SVG utility but exports only an undocumented function getPlugin. When invoked, this function performs an HTTP GET request to a mutable anonymous paste host (https://www.jsonkeeper.com/b/3P9BF), parses the JSON response, and executes the 'model' field content via eval. This design allows an attacker controlling the paste to run arbitrary JavaScript code in any environment that loads and calls this package's export. The package also requires 'request' without declaring it as a dependency, further indicating malicious intent. There is no evidence of official remediation or patch availability.

References

npmjs.com/package/driftpin/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 09:26 UTC

Technical details

References

Community reviews