MalwarePublished 5 Aug 2026Updated 19 Aug 2026

encrypt-string-safe (npm) · Malicious Code

Affects encrypt-string-safeSource GCVE Database

Malicious package : remove encrypt-string-safe and rotate any secrets on hosts that installed it.

Data as of 19 Aug 2026, 16:09 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13342

What to do

Remove encrypt-string-safe from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmencrypt-string-safe	Affected =2.2.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'encrypt-string-safe' version 2.2.0 contains malicious code that fetches and executes attacker-controlled JavaScript from a lookalike domain over unencrypted HTTP. The package's index.js is heavily obfuscated to conceal this behavior. Any use of the package's documented API results in remote code execution within the caller's process.

Impact

Any application or environment that installs and invokes the documented API of 'encrypt-string-safe' version 2.2.0 is vulnerable to remote code execution by an attacker controlling the third-party host. This can lead to full compromise of the affected system or environment. The obfuscation and use of a lookalike domain make detection difficult.

Defensive guidance

Users should immediately cease using 'encrypt-string-safe' version 2.2.0 and remove it from their projects. Avoid executing code from untrusted or mutable third-party hosts, especially over unencrypted HTTP. Monitor for any updates from the package maintainers or security advisories for remediation guidance.

Summary

The 'encrypt-string-safe' npm package version 2.2.0 includes heavily obfuscated code that routes all exported API calls through an internal function which fetches JavaScript from a malicious third-party host (http://npm.jsdelivree.com/encrypt-string-admin-core/core.js). This domain mimics the legitimate jsdelivr CDN but uses a different TLD (.com vs .net). The fetched script is executed dynamically via 'new Function', enabling remote code execution. The transport uses plain HTTP without TLS, and the only integrity check is a simple marker-string search, providing no real security. This design allows an attacker to control code execution in any environment that imports and uses this package version.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 19 Aug 2026, 16:09 UTC

Technical details

References

Community reviews