MalwarePublished 12 Aug 2026

gdwkh6vcbu (npm) · Malicious Code

Affects gdwkh6vcbuSource GCVE Database

Malicious package : remove gdwkh6vcbu and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:46 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13810

What to do

Remove gdwkh6vcbu from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmgdwkh6vcbu	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package gdwkh6vcbu@1.0.0 contains malicious code designed to serve an obfuscated phishing landing page. It impersonates a Cloudflare Turnstile verification page and redirects users to a malicious URL. The package does not execute code during installation but abuses npm CDN mirrors to distribute phishing content targeting end-user browsers. Installing this package may lead to full system compromise, requiring immediate secret and key rotation and package removal.

Impact

The package's presence indicates a high risk of phishing attacks against end users via npm CDN mirrors. Although it does not execute code on the developer's machine during installation, it serves obfuscated phishing content to browsers, potentially leading to credential theft or other malicious outcomes. The ghsa-malware advisory states that any computer with this package installed or running should be considered fully compromised, implying possible backdoors or additional malware beyond the phishing page. Secrets and keys stored on the compromised system must be rotated immediately.

Defensive guidance

Remove the gdwkh6vcbu package immediately from all systems. Rotate all secrets and keys from a secure, uncompromised environment. Since the package does not execute code during installation but serves phishing content via npm CDN mirrors, avoid using untrusted or suspicious npm packages, especially those with placeholder metadata and no legitimate functionality. Monitor for any signs of compromise and consider full system forensic analysis due to the risk of full compromise. Patch status is not applicable as this is a malicious package, not a vulnerability with a fix.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:46 UTC

Technical details

References

Community reviews