MalwarePublished 11 Jun 2026Updated 15 Jul 2026

fastify-addon (npm) · Malicious Code

Affects fastify-addonSource GCVE Database

Malicious package : remove fastify-addon and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:50 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5566

What to do

Remove fastify-addon from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmfastify-addon	Affected =5.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The fastify-addon npm package is a malicious typosquatting package impersonating the legitimate fastify-plugin. It fetches attacker-controlled JavaScript code from a mutable third-party JSON paste service and executes it via eval at runtime. This allows arbitrary code execution with full access to the host environment, including credentials and filesystem. Any system requiring this package is considered fully compromised. Immediate removal and secret/key rotation are strongly advised.

Impact

Any process that requires fastify-addon will execute attacker-controlled code with full access to the environment, credentials, and filesystem. This leads to complete compromise of the affected system. All secrets and keys stored on the compromised system should be considered exposed and must be rotated from a clean environment. Removal of the package alone does not guarantee eradication of all malicious artifacts.

Defensive guidance

The package should be immediately removed from all systems. All secrets and credentials stored on affected systems must be rotated from a secure, uncompromised environment. Due to the full compromise risk, affected systems should be thoroughly audited and potentially rebuilt to ensure no persistent malicious code remains.

Summary

fastify-addon is a typosquatting malicious package targeting users expecting fastify-plugin. Its package.json and README mimic the legitimate package to deceive users. Upon require, it executes a script that fetches a base64-encoded URL pointing to a JSON paste service, retrieves the 'content' field, and executes it with eval. Because the payload is hosted on a mutable third-party service, the attacker can change the executed code at any time, resulting in arbitrary code execution with full privileges in the consumer environment. This compromises the host system entirely.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 12:50 UTC

Technical details

References

Community reviews