MalwarePublished 9 Jul 2026

eslint-plus (npm) · Malicious Code

Affects eslint-plusSource GCVE Database

Malicious package : remove eslint-plus and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 10:05 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10087

What to do

Remove eslint-plus from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmeslint-plus	Affected =6.0.5 =6.0.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package eslint-plus versions 6.0.4 and 6.0.5 contains malicious code that executes arbitrary JavaScript with full Node.js privileges during installation. It achieves this by running a detached, hidden child process that fetches and executes code from a publicly editable JSON paste service, allowing the attacker to change the executed payload at any time. The package impersonates legitimate tooling by referencing React Training and eslint but actually includes a copied nodemailer source tree as a cover for the malicious dropper.

Impact

This vulnerability allows an attacker to execute arbitrary code with full Node.js privileges on any system that installs the affected eslint-plus package versions. Because the executed code is fetched from a publicly editable source, the attacker can change the payload at any time, potentially leading to persistent and evolving compromise of the affected systems. The malicious code runs silently and detached from the installation process, making detection difficult.

Defensive guidance

Users should avoid installing eslint-plus versions 6.0.4 and 6.0.5. Since the package fetches and executes code from a public, mutable source, uninstalling the package and removing any installed instances is recommended. Monitor for any suspicious activity related to this package.

Summary

The eslint-plus npm package (versions 6.0.4 and 6.0.5) includes a postinstall script that spawns a detached Node.js child process running a script which fetches JavaScript code from https://jsonkeeper.com/b/UTUUE. This code is executed dynamically with full privileges using the Function constructor, enabling arbitrary code execution on the installer's machine. The use of detached, stdio-suppressed, and unreferenced child processes hides the activity from the user and allows the malicious code to persist after installation completes. The package also attempts to impersonate legitimate eslint tooling by referencing React Training and including nodemailer source code under a false author name, indicating deliberate obfuscation and malicious intent.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 10:05 UTC

Technical details

References

Community reviews