MalwarePublished 12 Aug 2026

dzcvhfruwluwe (npm) · Malicious Code

Affects dzcvhfruwluweSource GCVE Database

Malicious package : remove dzcvhfruwluwe and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:59 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13803

What to do

Remove dzcvhfruwluwe from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdzcvhfruwluwe	Affected =1.0.1 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'dzcvhfruwluwe' versions 1.0.0 and 1.0.1 contains a malicious index.html file that acts as a fake 'Cloudflare Verifying...' page. This page uses obfuscated JavaScript to redirect users' browsers after a short delay to an attacker-controlled external domain. The malicious behavior is client-side and does not execute during package installation or require-time, meaning it does not compromise the developer's environment directly. However, end users who load the HTML file in a browser are redirected to potentially harmful sites. This is a case of registry abuse hosting phishing or malvertising content rather than a traditional supply-chain attack. There is no CVSS score available for this threat. The package should be removed, and any secrets on compromised machines should be rotated due to the risk of full compromise.

Impact

End users who load the malicious index.html file in a browser are redirected to an attacker-controlled domain, potentially exposing them to phishing or malvertising content. The package does not execute malicious code during installation or runtime in the developer environment, so the direct impact on developers is limited. However, the ghsa-malware advisory states that any computer with this package installed or running should be considered fully compromised, implying that the package may be part of a broader compromise or that additional malicious components may be present. Secrets and keys on affected machines should be rotated immediately. There is no evidence of active exploitation in the wild.

Defensive guidance

Remove the 'dzcvhfruwluwe' package from all affected systems. Immediately rotate all secrets and keys stored on any computer where this package was installed or running, using a different, uncompromised machine. Since the malicious payload is browser-side and the package does not execute during installation, ensure users do not open the index.html file from this package. Monitor for any further signs of compromise as removal of the package alone may not eliminate all malicious software.

Summary

The npm package 'dzcvhfruwluwe' (versions 1.0.0 and 1.0.1) contains a single file, index.html, which displays a fake 'Cloudflare Verifying...' page. This page includes an obfuscated script that reconstructs a URL to an attacker-controlled domain and redirects the browser to that domain after a 1-second timeout using window.location.replace. The package.json does not define lifecycle scripts and points the main entry to the HTML file, so the malicious payload does not execute during npm install or require(). The threat is limited to browser-side redirection for users who load the HTML file, representing registry abuse for phishing or malvertising purposes rather than a supply-chain compromise of the developer environment. The advisory from ghsa-malware warns that any computer with this package installed or running should be considered fully compromised, recommending immediate secret/key rotation and package removal, though removal may not eliminate all malicious software.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:59 UTC

Technical details

References

Community reviews