MalwarePublished 13 Jul 2026Updated 1 Sep 2026

gamified-trading-system (npm) · Malicious Code

Affects gamified-trading-systemSource GCVE Database

Malicious package : remove gamified-trading-system and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 15:33 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10502

What to do

Remove gamified-trading-system from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmgamified-trading-system	Affected =3.6.2 =3.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'gamified-trading-system' contains malicious code that acts as a remote loader, fetching and executing arbitrary code from an attacker-controlled endpoint. It masquerades as a trading gamification library but exports only functions that load and execute remote payloads with full Node.js module privileges. The package also includes dependencies and artifacts consistent with credential theft and machine fingerprinting, and ships with an embedded private SSH key, indicating hostile provenance. Installation of this package results in full compromise of the host system.

Impact

Systems with this package installed are fully compromised, as the attacker can execute arbitrary code with full privileges within the Node.js environment. This includes potential credential theft, machine fingerprinting, and persistent backdoors. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

Defensive guidance

Immediate removal of the 'gamified-trading-system' package is required. However, because the package enables arbitrary code execution, the affected system should be treated as fully compromised. All credentials, keys, and secrets stored on the system must be rotated from a separate, trusted environment.

Summary

The 'gamified-trading-system' npm package falsely advertises trading gamification features but instead exports functions that assemble a URL to fetch remote JavaScript code from an attacker-controlled server. This code is executed dynamically in the Node.js process with full privileges, enabling arbitrary code execution. A decoy function fetches benign SVGs to camouflage the malicious loader. The package's dependencies align with known credential-decryption and machine fingerprinting tools targeting Windows systems. Additionally, the package contains an embedded ed25519 OpenSSH private key, confirming malicious intent and poor operational security by the attacker. Any system with this package installed is considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 15:33 UTC

Technical details

References

Community reviews