MalwarePublished 21 Sep 2026Updated 30 Sep 2026

feed-widget-helper (npm) · Malicious Code

Affects feed-widget-helperSource GCVE Database

Malicious package : remove feed-widget-helper and rotate any secrets on hosts that installed it.

Data as of 30 Sep 2026, 16:37 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-16332

What to do

Remove feed-widget-helper from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmfeed-widget-helper	Affected =1.0.0 =1.0.8 =1.0.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'feed-widget-helper' contains malicious code that, upon loading, automatically fetches private profile data from the same origin and exfiltrates it by posting to a state-changing endpoint without user interaction. The package masquerades as a helper library but is actually a same-origin CSRF and data exfiltration payload. The package metadata is empty or placeholder, indicating it is not a legitimate utility. Any system with this package installed should be considered fully compromised, and all stored secrets and keys should be rotated immediately.

Impact

Systems with this package installed are fully compromised. The malicious code can steal private profile data accessible via the authenticated session and exfiltrate it to an attacker-controlled endpoint on the same origin. This leads to unauthorized disclosure of sensitive information. Because the package runs code with the user's privileges and session, it may also facilitate further system compromise. All secrets and keys stored on the affected system are at risk and should be considered compromised.

Defensive guidance

Remove the 'feed-widget-helper' package immediately from all affected systems. Rotate all secrets, keys, and credentials stored on compromised systems from a separate, secure environment. Because the package grants potential full control to an attacker, consider rebuilding or thoroughly cleaning affected systems.

Summary

The 'feed-widget-helper' npm package (versions 1.0.0, 1.0.6, and 1.0.8) contains malicious code that schedules a delayed fetch of the current origin's /profile endpoint, parses the HTML to extract sensitive data, and then sends this data via a POST request to /addPost on the same origin. This occurs automatically without user interaction and leverages the authenticated session of the embedding page, effectively performing a same-origin CSRF attack combined with data exfiltration. The package metadata is empty or placeholder, and the shipped code does not provide any legitimate feed-widget functionality, confirming its malicious intent. The package compromises the host system, potentially allowing attackers full control.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Sep 2026, 16:37 UTC

Technical details

References

Community reviews