gmail-changer (npm) · Malicious Code
Affects gmail-changerSource GCVE Database
Malicious package : remove gmail-changer and rotate any secrets on hosts that installed it.
Data as of 15 Jul 2026, 12:59 UTC
Malicious package
Published to npm · OSV MAL-2026-10635
What to do
Remove gmail-changer from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmgmail-changer | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'gmail-changer' version 2.0.2 contains malicious code designed to facilitate Gmail account takeovers using stolen session cookies. It automates a sequence of actions that remove the victim's recovery phone number, add an attacker-controlled recovery email, reset the password, sign out other devices, harvest 2FA secrets, and change the display name. The package also intercepts OTPs via a hardcoded SMS rental service and enumerates the victim's mailbox for reconnaissance. There is no legitimate use case for this package; it serves as an operational account-takeover tool with embedded attacker infrastructure.