MalwarePublished 12 Jun 2026Updated 15 Jul 2026

friendly-greeter-demo (npm) · Malicious Code

Affects friendly-greeter-demoSource GCVE Database

Malicious package : remove friendly-greeter-demo and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:45 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5704

What to do

Remove friendly-greeter-demo from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmfriendly-greeter-demo	Affected 1.0.0 – 1.0.14 11 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package friendly-greeter-demo contains malicious code that establishes two independent remote code execution channels. Upon installation, a postinstall script runs a detached daemon that communicates with an attacker-controlled server, sending host identifiers and executing arbitrary shell commands received from the server. Additionally, the main package code triggers the same behavior whenever it is imported or required. This results in full compromise of any system installing or running the package. Secrets and keys on affected systems should be rotated, and the package removed, though full remediation may require rebuilding the system due to potential persistent compromise.

Impact

Any system that installs or runs friendly-greeter-demo is fully compromised, as the attacker gains arbitrary remote code execution capabilities. Host identifiers and command outputs are exfiltrated, potentially exposing sensitive information. The attacker can execute arbitrary shell commands, leading to complete system takeover. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately from a clean environment.

Defensive guidance

The recommended mitigation is to immediately remove the friendly-greeter-demo package from all affected systems. Due to the nature of the compromise, full system remediation may require rebuilding the affected machines from trusted sources. All secrets and credentials stored on compromised systems should be rotated from a separate, secure environment. Monitor for any signs of persistent compromise or additional malware.

Summary

The friendly-greeter-demo npm package contains embedded malicious code that activates automatically via two mechanisms: a postinstall.js script that runs on npm install and respawns itself as a detached daemon, and an immediately invoked function expression (IIFE) in index.js that triggers on package import. Both mechanisms communicate with a hardcoded attacker-controlled IP (http://98.86.244.177:8080), registering the host and polling for shell commands to execute. Command outputs and host identifiers are exfiltrated over plain HTTP. This provides an attacker with arbitrary remote code execution on the affected system under the install user's privileges.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 12:45 UTC

Technical details

References

Community reviews