MalwarePublished 26 Apr 2026Updated 3 Sep 2026

frank-bot-gogle-cloning (npm) · Malicious Code

Affects frank-bot-gogle-cloningSource GCVE Database

What to do

Affected software

Product	Affected	Fixed in
npmfrank-bot-gogle-cloning	Affected =1.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'frank-bot-gogle-cloning' version 1.1.0 contains malicious code that executes commands associated with malicious behavior. Installing or running this package can fully compromise the affected computer, potentially exposing all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious software introduced. Immediate rotation of all secrets and keys from a separate, uncompromised system is strongly advised.

Impact

Any system with 'frank-bot-gogle-cloning' version 1.1.0 installed or running should be considered fully compromised. Attackers may have gained full control, risking exposure and theft of sensitive information such as secrets and keys. The integrity and confidentiality of the affected system are severely impacted.

Defensive guidance

Remove the 'frank-bot-gogle-cloning' package version 1.1.0 immediately. Rotate all secrets and keys from a different, uncompromised system to prevent unauthorized access. Because the system may be fully compromised, consider a full system rebuild or forensic analysis to ensure all malicious artifacts are removed.

Summary

The 'frank-bot-gogle-cloning' npm package at version 1.1.0 has been identified as malicious by multiple sources including Amazon Inspector, GHSA Malware, and the OpenSSF Package Analysis project. The package executes commands linked to malicious activity, leading to full compromise of any system where it is installed or running. This compromise includes potential unauthorized access to secrets and keys stored on the system. Due to the nature of the compromise, simply removing the package may not fully remediate the infection.

References

github.com/advisories/GHSA-52j3-fx2q-cqm9 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Sep 2026, 20:09 UTC

Technical details

References

Community reviews