Malicious code in dzvchorehui2 (npm)
The npm package dzvchorehui2 version 1.0.0 contains a single HTML file that impersonates a Cloudflare 'Just a moment' challenge screen. This file includes an obfuscated script that redirects users to an external phishing domain. The malicious code does not execute during installation or import, and the package lacks lifecycle scripts or network activity at install time. The package's primary threat is serving as a client-side phishing landing page if hosted. Despite no direct execution on the installer's machine, the presence of this package indicates a potential compromise, as reported by one source claiming full system compromise upon installation.
AI Analysis
Technical Summary
The dzvchorehui2 npm package version 1.0.0 contains a single HTML file designed to impersonate a Cloudflare challenge screen. It uses an obfuscated inline script to reconstruct a URL to the external domain ofte.live, appending current query parameters and redirecting the browser via window.location.replace. The package does not execute code during installation or import, has no lifecycle scripts, and does not perform network activity or read environment or credential data on the installer's machine. Its purpose is to serve a phishing landing page if hosted, representing a client-side phishing threat rather than a direct supply-chain code execution payload. However, a secondary source claims that any system with this package installed should be considered fully compromised, recommending immediate secret rotation and removal of the package, though removal may not guarantee full remediation.
Potential Impact
The package itself does not execute malicious code during installation or import, so it does not directly compromise the installer's system through code execution or credential theft at install time. However, if the HTML file is hosted and accessed by users, it can serve as a phishing page impersonating Cloudflare, potentially leading to credential theft or other phishing impacts. One source asserts that installation indicates full system compromise, implying possible additional undetected malicious activity, but this is not corroborated by the technical details. The primary confirmed impact is phishing via the hosted HTML page.
Mitigation Recommendations
No official patch or fix is available for this package. The recommended mitigation is to remove the dzvchorehui2 package version 1.0.0 immediately if installed. If the package has been installed or run, it is advised to consider the system potentially compromised and rotate all secrets and keys from a different, trusted system. Because the package does not execute code at install or import time, the risk is primarily from hosting or serving the malicious HTML file. Removal alone may not guarantee full remediation if additional compromise has occurred.
Malicious code in dzvchorehui2 (npm)
Description
The npm package dzvchorehui2 version 1.0.0 contains a single HTML file that impersonates a Cloudflare 'Just a moment' challenge screen. This file includes an obfuscated script that redirects users to an external phishing domain. The malicious code does not execute during installation or import, and the package lacks lifecycle scripts or network activity at install time. The package's primary threat is serving as a client-side phishing landing page if hosted. Despite no direct execution on the installer's machine, the presence of this package indicates a potential compromise, as reported by one source claiming full system compromise upon installation.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The dzvchorehui2 npm package version 1.0.0 contains a single HTML file designed to impersonate a Cloudflare challenge screen. It uses an obfuscated inline script to reconstruct a URL to the external domain ofte.live, appending current query parameters and redirecting the browser via window.location.replace. The package does not execute code during installation or import, has no lifecycle scripts, and does not perform network activity or read environment or credential data on the installer's machine. Its purpose is to serve a phishing landing page if hosted, representing a client-side phishing threat rather than a direct supply-chain code execution payload. However, a secondary source claims that any system with this package installed should be considered fully compromised, recommending immediate secret rotation and removal of the package, though removal may not guarantee full remediation.
Potential Impact
The package itself does not execute malicious code during installation or import, so it does not directly compromise the installer's system through code execution or credential theft at install time. However, if the HTML file is hosted and accessed by users, it can serve as a phishing page impersonating Cloudflare, potentially leading to credential theft or other phishing impacts. One source asserts that installation indicates full system compromise, implying possible additional undetected malicious activity, but this is not corroborated by the technical details. The primary confirmed impact is phishing via the hosted HTML page.
Mitigation Recommendations
No official patch or fix is available for this package. The recommended mitigation is to remove the dzvchorehui2 package version 1.0.0 immediately if installed. If the package has been installed or run, it is advised to consider the system potentially compromised and rotate all secrets and keys from a different, trusted system. Because the package does not execute code at install or import time, the risk is primarily from hosting or serving the malicious HTML file. Removal alone may not guarantee full remediation if additional compromise has occurred.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13804
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-cj4c-xm2v-8m5g"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a7c9b4dbf8831d539cdd74c
Added to database: 08/12/2026, 16:11:57 UTC
Last enriched: 08/12/2026, 16:59:15 UTC
Last updated: 08/13/2026, 01:39:32 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.