MalwarePublished 24 Jun 2026Updated 20 Aug 2026

evil-pkg (npm) · Malicious Code

Affects evil-pkgSource GCVE Database

Malicious package : remove evil-pkg and rotate any secrets on hosts that installed it.

Data as of 20 Aug 2026, 16:57 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6374

What to do

Remove evil-pkg from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmevil-pkg	Affected 1.0.0 – 1.0.5 6 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'evil-pkg' versions 1.0.0 through 1.0.5 contains malicious code that hijacks the 'node' command by registering a shim script in the local bin directory. This shim executes during package installation, allowing unconsented code execution with the installer's privileges. The current payload is benign but demonstrates a supply-chain attack vector capable of exfiltrating sensitive files. Any system with this package installed should be considered compromised, and secrets should be rotated immediately.

Impact

Systems that install 'evil-pkg' versions 1.0.0 through 1.0.5 are at risk of unconsented code execution during package installation. This can lead to full system compromise, including unauthorized access to sensitive files and credentials. The attack vector hijacks the core 'node' runtime command, potentially affecting other packages and scripts during installation. Because the malicious code runs with the installer's privileges, attackers can gain extensive control over the affected system. Removal of the package alone may not fully remediate the compromise, and all secrets should be rotated from a secure environment.

Defensive guidance

Users should immediately remove 'evil-pkg' versions 1.0.0 through 1.0.5 from their environments. Given the potential full compromise, all secrets and keys stored on affected systems should be rotated from a different, trusted machine. Monitor for suspicious activity related to package installations and avoid using this package. Since the package is malicious by design, do not trust any code or binaries installed alongside it.

Summary

The 'evil-pkg' npm package declares a 'bin' entry that registers a shim script named 'node' in 'node_modules/.bin'. When this directory is prepended to the PATH, any invocation of 'node' during package installation runs the shim instead of the legitimate Node.js runtime. The shim writes a marker file and prints a hijack banner, demonstrating a fully functional code execution channel. This mechanism enables an attacker to run arbitrary code with the installer's privileges during installation lifecycle scripts. The package README explicitly markets this as a proof-of-concept for PATH-poisoning attacks and notes that real attackers could exfiltrate sensitive files like '.env', '~/.ssh', and '~/.npmrc'. This behavior constitutes a deliberate supply-chain attack vector. Versions 1.0.0 through 1.0.5 are affected.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 20 Aug 2026, 16:57 UTC

Technical details

References

Community reviews