VulnerabilityPublished 07/25/2026Updated 08/05/2026

Malicious code in fundraiserservicepp (npm)

Affects fundraiserserviceppSource GCVE Database

Severity

High

Rated by Threat Radar

What to do

AI-suggested

No official patch or remediation is currently available for this malicious package. Users and organizations should avoid installing 'fundraiserservicepp' version 1.5.0 from npm. If already installed, remove the package immediately and investigate any potential data exposure. Monitor for any network connections to the identified malicious domain and block such traffic at network boundaries. Use trusted sources and verify package integrity before installation to prevent supply chain compromise.

Affected software

Product	Affected	Fixed in
npmfundraiserservicepp	Affected =1.5.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'fundraiserservicepp' version 1.5.0 is identified as malicious. During installation, its preinstall script executes code that collects host system information such as hostname, platform, and architecture, then sends this data over HTTPS to a hardcoded third-party domain associated with malicious activity. The package does not provide any legitimate functionality and behaves like a dependency confusion probe, exfiltrating system identifiers without user consent.

Summary

The 'fundraiserservicepp' npm package at version 1.5.0 contains malicious code executed during its preinstall lifecycle event. This code collects system information including os.hostname(), os.platform(), and os.arch() and transmits it as JSON via HTTPS to a hardcoded subdomain linked to malicious activity. The package lacks advertised functionality beyond this data exfiltration behavior, indicating it is designed to collect and leak host environment details without user authorization. This behavior was identified by Amazon Inspector and the OpenSSF Package Analysis project, which flagged the package as malicious due to its communication with a known malicious domain.

Impact

The malicious package can leak sensitive host environment information such as hostname, operating system platform, and architecture to an external attacker-controlled server. This data exposure can aid attackers in profiling the victim environment for further targeted attacks or exploitation. Since the package executes this behavior automatically during installation without user consent, it poses a privacy and security risk to systems that install it.

What to do

Affected software

Description

AnalysisAI-generated, updated 08/05/2026, 17:55:02 UTC

Technical details

References

Related threats