@ghost_debugger/nanocache (npm) · Malicious Code
Affects @ghost_debugger/nanocacheSource GCVE Database
Malicious package : remove @ghost_debugger/nanocache and rotate any secrets on hosts that installed it.
Data as of 15 Aug 2026, 15:54 UTC
Malicious package
Published to npm · OSV MAL-2026-14046
What to do
Remove @ghost_debugger/nanocache from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@ghost_debugger/nanocache | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c027fa29f4577bd052bfda553a617994365ea5855216b877e900610542f4bcce) On require/import, the package spawns a bundled 1.1 MB Windows executable at vendor/nanocache.exe as a detached background process with stdio ignored, windowsHide set, and child.unref() so it survives parent exit. The declared purpose is an in-memory LRU+TTL cache, which does not require a native background process, and the binary is not built from source shipped in the tarball. Strings inside the executable include `/ws/agent`, `disconnect`, `update`, and `exit_code`, consistent with a WebSocket-based remote agent that accepts commands from a remote controller. The README further describes vendor/nanocache.exe as a drop-in slot for an arbitrary Windows executable, indicating the npm module functions as a generic launcher for the bundled binary. Installing or importing the package on a Windows host results in an opaque, hidden native process being launched under a cache-library cover story, giving a remote party persistent control over the installer's machine.