MalwarePublished 26 May 2026Updated 13 Jul 2026

fpjson-lang (npm) · Malicious Code

Affects fpjson-langSource GCVE Database

Malicious package : remove fpjson-lang and rotate any secrets on hosts that installed it.

Data as of 13 Jul 2026, 09:24 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-4566

What to do

Remove fpjson-lang from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmfpjson-lang	Affected =0.1.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package fpjson-lang version 0.1.7 contains a malicious preinstall script that executes a packed Linux ELF binary during installation. This binary is unrelated to the package's declared functionality and includes capabilities such as HTTP client, GitHub API interaction, ptrace, cryptographic operations, and an eBPF-based kernel rootkit. The malware is part of the IronWorm campaign and acts as an infostealer targeting developer credentials, cloud services, cryptocurrency wallets, and exhibits worm-like behavior to propagate by pushing malicious updates to repositories. Removal of the package does not guarantee full remediation due to potential system compromise.

Impact

Systems installing fpjson-lang 0.1.7 are subject to arbitrary code execution at install time, leading to full system compromise. The malware steals sensitive credentials for cloud providers, databases, source control, package registries, AI tools, and cryptocurrency wallets. It can maintain persistence via a kernel rootkit and propagate by compromising developer repositories and publishing malicious packages. This results in significant risk of data theft, credential leakage, and further supply chain compromise.

Defensive guidance

Users should immediately remove fpjson-lang version 0.1.7 from their environments. Due to the high likelihood of full system compromise, all secrets and keys stored on affected machines must be rotated from a separate, trusted device. Comprehensive incident response and system remediation are recommended, including forensic analysis and potential system rebuilds. Monitor for any signs of persistence or further compromise.

Summary

fpjson-lang version 0.1.7 is compromised by the IronWorm campaign, which embeds a malicious Rust-built binary executed at npm install time via a preinstall hook. This binary acts as an infostealer targeting a wide range of developer-related credentials and cryptocurrency wallets, including injecting malicious hooks into the Exodus wallet. It also uses an eBPF-based kernel rootkit on Linux to hide its presence and exhibits worm-like propagation by stealing GitHub and npm credentials to push trojanized updates. The package's legitimate JavaScript code is minimal and unrelated to the malicious payload, which is opaque and packed, indicating a deliberate install-time dropper pattern. Systems with this package installed should be considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Jul 2026, 09:24 UTC

Technical details

References

Community reviews