MalwarePublished 29 Oct 2025Updated 31 Oct 2025

esg-odf-common (npm) · Malicious Code

Affects esg-odf-commonSource GCVE Database

Malicious package : remove esg-odf-common and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 23:24 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-49083

What to do

Remove esg-odf-common from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmesg-odf-common	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package esg-odf-common contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is advised, but due to the potential for full control by an attacker, removal alone may not eliminate all malicious components. Secrets and keys should be rotated from a separate, secure system.

Impact

Systems with the esg-odf-common package installed are fully compromised, potentially allowing attackers complete control over the system and access to all stored secrets and keys. This can lead to unauthorized data access, credential theft, and further system exploitation.

Defensive guidance

Remove the esg-odf-common package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, secure computer. Because the system may be fully compromised, consider rebuilding affected machines to ensure complete removal of malicious components.

Summary

The npm package esg-odf-common was identified by Amazon Inspector and GHSA as containing malicious code. Any system with this package installed should be considered fully compromised, with potential unauthorized access to stored secrets and keys. The package's presence indicates a severe security risk, and remediation involves package removal and immediate rotation of all secrets and keys from a different, uncompromised machine. There is no indication of a patch or fixed version, and the threat is not a vulnerability but a malicious package.

References

github.com/advisories/GHSA-53xv-qxw8-mc6g (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 23:24 UTC

Technical details

References

Community reviews