MalwarePublished 15 Jun 2026Updated 5 Aug 2026

field-plus (npm) · Malicious Code

Affects field-plusSource GCVE Database

Malicious package : remove field-plus and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5777

What to do

Remove field-plus from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmfield-plus	Affected =99.99.1 =99.99.2 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'field-plus' versions 99.99.1 and 99.99.2 contain malicious code that executes during installation. The package.json file includes preinstall and postinstall scripts that silently send identifying information such as username, hostname, current directory, and timestamp to a hardcoded IP address. The package lacks any legitimate functionality and is used as a dependency-confusion or namespace-squatting probe. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation and removal of the package.

Impact

Installation of the malicious 'field-plus' package results in the exfiltration of sensitive system information to an attacker-controlled server. The package's presence indicates a high likelihood of full system compromise, potentially allowing attackers to access all secrets and keys stored on the affected computer. Removal of the package alone may not eliminate all malicious artifacts or backdoors introduced during installation.

Defensive guidance

Immediate removal of the 'field-plus' package versions 99.99.1 and 99.99.2 is required. All secrets, keys, and credentials stored on the affected system should be rotated from a trusted, uncompromised environment. Monitor for any signs of persistent compromise and consider a full system forensic analysis and rebuild if necessary.

Summary

The 'field-plus' npm package versions 99.99.1 and 99.99.2 include malicious preinstall and postinstall scripts that execute a curl command to a hardcoded HTTP endpoint, transmitting sensitive environment details of the installer. The package tarball contains only a package.json file without the declared main index.js, indicating no legitimate functionality. This behavior is consistent with a dependency-confusion or namespace-squatting attack designed to identify organizations resolving internal package names from the public registry. According to the GHSA advisory, any system with this package installed should be considered fully compromised, necessitating secret rotation and package removal.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 16 Jul 2026, 10:43 UTC

Technical details

References

Community reviews