MalwarePublished 9 Jul 2026

@equansservices/setup (npm) · Malicious Code

Affects @equansservices/setupSource GCVE Database

Malicious package : remove @equansservices/setup and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 09:53 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10094

What to do

Remove @equansservices/setup from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@equansservices/setup	Affected 1.0.0 – 1.0.3 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @equansservices/setup contains malicious code that executes an unauthenticated binary fetched over plain HTTP during installation. The package uses a postinstall hook to download and run a platform-specific executable from an untrusted CloudFront URL without any integrity verification. It impersonates the Equans brand and Anthropic Claude tooling, likely as a typosquatting attack targeting developers. Versions 1.0.0, 1.0.1, 1.0.2, and 1.0.3 are affected. No official patch or remediation guidance is provided.

Impact

Installing any of the affected versions of @equansservices/setup results in execution of an unauthenticated, unsigned binary fetched over an unencrypted channel. This can lead to arbitrary code execution on the installer's system without their knowledge or consent. The malicious payload runs detached and hidden, increasing the risk of persistent compromise or further malicious activity. The package's impersonation of trusted brands may increase the likelihood of installation by developers seeking related tooling.

Defensive guidance

Users should avoid installing the @equansservices/setup package, especially versions 1.0.0 through 1.0.3. Verify the authenticity of packages before installation and prefer official sources. Monitor for any updates from the vendor or npm regarding remediation. Since the package fetches and executes code over plain HTTP without verification, blocking network access to the specified CloudFront URL may reduce risk.

Summary

The @equansservices/setup npm package includes a postinstall script that automatically runs on npm install. This script downloads a platform-specific archive over plain HTTP from a CloudFront URL, extracts it, and executes a binary (setup.exe on Windows or python3 setup.py on Linux) detached and hidden from the user. The package impersonates legitimate brands to deceive users. The downloaded payload is opaque, unpinned, and lacks any hash or signature verification, creating a risk of executing malicious code on the installer's machine. The affected versions are exactly 1.0.0, 1.0.1, 1.0.2, and 1.0.3.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 09:53 UTC

Technical details

References

Community reviews