MalwarePublished 12 Aug 2026

egypt0811 (npm) · Malicious Code

Affects egypt0811Source GCVE Database

Malicious package : remove egypt0811 and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:59 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13806

What to do

Remove egypt0811 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmegypt0811	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'egypt0811' version 1.0.0 contains a malicious index.html file that acts as a redirect page styled like a Cloudflare Turnstile interstitial. It includes obfuscated JavaScript that redirects browsers to a phishing or malicious destination URL. The package does not execute code during installation or require-time and does not contain Node.js modules or lifecycle scripts. This behavior indicates registry abuse to host a phishing redirect page rather than a direct supply-chain attack on developers. Any system with this package installed should be considered compromised, and secrets should be rotated immediately.

Impact

The presence of this package on a system indicates a full compromise, as stated by the GHSA malware advisory. The package itself does not execute code during installation or runtime in Node.js environments, but the included HTML file can redirect browsers to potentially malicious phishing sites if opened directly. This can lead to credential theft or further compromise. The advisory warns that all secrets and keys on affected systems should be rotated immediately, as the attacker may have gained full control. Removing the package alone may not remove all malicious software resulting from the compromise.

Defensive guidance

Remove the 'egypt0811' package version 1.0.0 from all affected systems. Immediately rotate all secrets and keys from a different, trusted computer to prevent further unauthorized access. Because the package indicates a full system compromise, conduct a thorough investigation and remediation of the affected environment. There is no indication of an official patch or fix for this package, as it is a malicious package abuse rather than a software vulnerability. Monitor for any suspicious activity related to this package and avoid opening the index.html file in a browser.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:59 UTC

Technical details

References

Community reviews