Malicious code in gamified-trading-system (npm)
The npm package 'gamified-trading-system' versions 3.1.0 and 3.6.2 contains malicious code that acts as a remote loader. Instead of providing advertised gamification APIs, it fetches and executes arbitrary code from an attacker-controlled URL with full module privileges in the Node.js environment. It also includes dependencies and artifacts consistent with credential theft and machine fingerprinting on Windows systems. The package ships with a private SSH key, indicating hostile provenance.
AI Analysis
Technical Summary
The 'gamified-trading-system' npm package versions 3.1.0 and 3.6.2 is malicious. It exports functions that fetch JavaScript code from a remote attacker-controlled endpoint and executes it dynamically with full Node.js module privileges, enabling arbitrary code execution. The package also fetches decoy resources to camouflage this behavior. Its declared dependencies align with payloads for Windows DPAPI credential decryption and machine fingerprinting. Additionally, it contains an embedded ed25519 OpenSSH private key, supporting the conclusion of hostile intent and poor provenance.
Potential Impact
An attacker controlling the remote endpoint can execute arbitrary code within the Node.js process of any system installing this package, potentially leading to full compromise of the host environment. The presence of dependencies related to Windows credential decryption and machine fingerprinting suggests potential for credential theft and persistent tracking. The embedded private key further indicates risk of unauthorized access or lateral movement.
Mitigation Recommendations
No official patch or remediation is currently available. Users should immediately remove and avoid using the affected versions (=3.1.0 and =3.6.2) of the 'gamified-trading-system' package. Verify the integrity and provenance of npm packages before installation, and consider using trusted package sources or internal mirrors. Monitor for any suspicious activity on systems where this package was installed.
Malicious code in gamified-trading-system (npm)
Description
The npm package 'gamified-trading-system' versions 3.1.0 and 3.6.2 contains malicious code that acts as a remote loader. Instead of providing advertised gamification APIs, it fetches and executes arbitrary code from an attacker-controlled URL with full module privileges in the Node.js environment. It also includes dependencies and artifacts consistent with credential theft and machine fingerprinting on Windows systems. The package ships with a private SSH key, indicating hostile provenance.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'gamified-trading-system' npm package versions 3.1.0 and 3.6.2 is malicious. It exports functions that fetch JavaScript code from a remote attacker-controlled endpoint and executes it dynamically with full Node.js module privileges, enabling arbitrary code execution. The package also fetches decoy resources to camouflage this behavior. Its declared dependencies align with payloads for Windows DPAPI credential decryption and machine fingerprinting. Additionally, it contains an embedded ed25519 OpenSSH private key, supporting the conclusion of hostile intent and poor provenance.
Potential Impact
An attacker controlling the remote endpoint can execute arbitrary code within the Node.js process of any system installing this package, potentially leading to full compromise of the host environment. The presence of dependencies related to Windows credential decryption and machine fingerprinting suggests potential for credential theft and persistent tracking. The embedded private key further indicates risk of unauthorized access or lateral movement.
Mitigation Recommendations
No official patch or remediation is currently available. Users should immediately remove and avoid using the affected versions (=3.1.0 and =3.6.2) of the 'gamified-trading-system' package. Verify the integrity and provenance of npm packages before installation, and consider using trusted package sources or internal mirrors. Monitor for any suspicious activity on systems where this package was installed.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10502
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a55ff9068715ace432f4b1d
Added to database: 07/14/2026, 09:21:20 UTC
Last enriched: 07/14/2026, 09:48:30 UTC
Last updated: 07/29/2026, 03:51:26 UTC
Views: 26
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.