VulnerabilityPublished 20 May 2026Updated 1 Sep 2026

gator-client (npm) · Malicious Code

Affects gator-clientSource GCVE Database

Severity

Critical

Rated by Threat Radar

Data as of 8 Sep 2026, 10:38 UTC

What to do

Affected software

Product	Affected	Fixed in
npmgator-client	Affected =9.9.11	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Immediate removal of the gator-client package version 9.9.11 is recommended. All secrets, credentials, and keys stored on the affected system should be rotated from a separate, trusted environment. Due to the high likelihood of full system compromise, consider rebuilding the affected system from a known good state. Monitor for any signs of persistent backdoors or additional malicious software.

Description

The gator-client npm package version 9.9.11 contains malicious code that exfiltrates host identifiers via DNS queries to an attacker-controlled domain. The package collects sensitive system information such as username, hostname, and current working directory, then encodes and sends this data out-of-band using DNS resolution to bypass typical HTTP egress filters. The malicious behavior is obfuscated in the code to evade detection, and the package's advertised purpose is a cover story. Installation or use of this package compromises the host, and all secrets on the affected system should be rotated. Removal of the package does not guarantee full remediation due to potential further compromise.

Impact

Systems with gator-client version 9.9.11 installed are fully compromised. Sensitive host identifiers are leaked to an attacker-controlled domain, potentially enabling further targeted attacks. Because the package executes malicious code on install and runtime, attackers may have persistent access or control. All secrets and keys on the affected system should be considered exposed and rotated immediately. Removal of the package alone may not remove all malicious artifacts or backdoors.

Summary

The gator-client npm package (version 9.9.11) contains embedded malicious code that activates during installation and on every require call. It collects the operating system username, hostname, and the basename of the current working directory, then performs DNS resolution queries to a domain controlled by the attacker (oob.sl4x0.xyz). This DNS-based exfiltration is designed to bypass HTTP egress filtering. The code uses obfuscation techniques such as storing function and module names as decimal byte arrays decoded at runtime to evade naive string scanning. The package's stated purpose is a cover, with the actual code path leading only to the beacon functionality. The attacker infrastructure is confirmed by matching email and domain ownership. The compromise is severe, and any system with this package installed should be considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Sep 2026, 10:38 UTC

Technical details

References

Community reviews