MalwarePublished 29 Apr 2026Updated 30 Apr 2026

gcp-internal-research-poc (npm) · Malicious Code

Affects gcp-internal-research-pocSource GCVE Database

Malicious package : remove gcp-internal-research-poc and rotate any secrets on hosts that installed it.

Data as of 27 Oct 2026, 00:32 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-3173

What to do

Remove gcp-internal-research-poc from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmgcp-internal-research-poc	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'gcp-internal-research-poc' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to stored secrets and keys. Immediate removal of the package is advised, but due to potential full control by an attacker, removal alone may not eliminate all malicious components.

Impact

Full system compromise on any computer with the package installed or running. Potential unauthorized access to all stored secrets and keys, requiring immediate rotation. Removal of the package may not fully restore system integrity due to possible persistent malicious presence.

Defensive guidance

Remove the 'gcp-internal-research-poc' package immediately from all affected systems. Rotate all secrets and keys stored on compromised systems from a separate, secure computer. Conduct a thorough investigation and remediation as the attacker may have persistent access beyond the package itself.

Summary

The 'gcp-internal-research-poc' npm package has been identified as containing malicious code. According to source reports, any system with this package installed should be considered fully compromised. Attackers may have gained full control over the affected system, potentially accessing and exfiltrating secrets and keys stored on the device. The package should be removed promptly; however, because the attacker may have persistent access, additional remediation steps such as rotating all secrets and keys from a secure, unaffected system are necessary.

References

github.com/advisories/GHSA-hrw3-c2cr-c3gv (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 27 Oct 2026, 00:32 UTC

Technical details

References

Community reviews