MalwarePublished 1 Jul 2026Updated 13 Jul 2026

electron-orbit (npm) · Malicious Code

Affects electron-orbitSource GCVE Database

Malicious package : remove electron-orbit and rotate any secrets on hosts that installed it.

Data as of 14 Jul 2026, 10:47 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6723

What to do

Remove electron-orbit from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmelectron-orbit	Affected 1.0.3 – 1.0.36 31 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The electron-orbit npm package contains malicious code that activates when required in Node.js environments. It establishes a covert network connection using a custom TLS 1.3 implementation to an Azure blob storage endpoint, bypassing standard TLS interception and static inspection. The package collects environment variables related to PATH and the current working directory, sending this data encoded in the request URL to the attacker-controlled server. Activation is conditional, triggered only when a specific environment variable's SHA-256 hash matches a hardcoded value, allowing targeted execution in chosen environments such as CI pipelines. The package's advertised functionality is a pretext; it does not perform legitimate icon fetching or SVG rendering as claimed.

Impact

This malicious package exfiltrates sensitive environment information, including PATH variables and working directory, to an attacker-controlled Azure blob storage endpoint. The use of a custom TLS stack and obfuscation techniques bypasses standard network inspection tools, increasing stealth. Activation gating by a specific environment variable hash enables targeted attacks, reducing detection risk. This can lead to exposure of sensitive build or runtime environment details, potentially aiding further attacks or reconnaissance.

Defensive guidance

Users should avoid installing or requiring the electron-orbit npm package in their projects. Review dependency trees for inclusion of this package and remove or replace it with trusted alternatives. Monitor for any updates from the package maintainers or npm advisories for remediation guidance. Since this is a malicious package, the best mitigation is to prevent its use entirely.

Summary

The electron-orbit npm package, when imported, unconditionally initiates an auto-prefetch pipeline in Node.js contexts that opens a raw TCP socket to electronorbit.blob.core.windows.net on port 443. Instead of using standard HTTPS libraries, it implements a custom TLS 1.3 stack with XOR-obfuscated network strings to evade detection. During installation, it writes a marker file containing environment variables related to PATH and the current working directory, as well as system information in a decoy file. Upon require, it reads and encodes this marker data, appending it as a query string to the Azure blob URL, thereby exfiltrating environment details via HTTP request logs. The payload activates only if the SHA-256 hash of the environment variable BuildType matches a hardcoded substring, enabling stealthy, targeted activation. The package's claimed purpose of Electron runtime discovery is a cover for this malicious behavior.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 10:47 UTC

Technical details

References

Community reviews