MalwarePublished 25 Apr 2026Updated 4 May 2026

@google-pay-trust/cancelled (npm) · Malicious Code

Affects @google-pay-trust/cancelledSource GCVE Database

Malicious package : remove @google-pay-trust/cancelled and rotate any secrets on hosts that installed it.

Data as of 27 Oct 2026, 01:09 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-3062

What to do

Remove @google-pay-trust/cancelled from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@google-pay-trust/cancelled	Affected =99.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package '@google-pay-trust/cancelled' version 99.0.1 has been identified as containing malicious code. Installation or execution of this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious artifacts or control gained by attackers.

Impact

Any computer with this package installed or running should be considered fully compromised. Attackers may have access to all secrets and keys stored on the system. The compromise may persist even after removal of the package, indicating potential installation of additional malicious software or backdoors.

Defensive guidance

Immediately remove the '@google-pay-trust/cancelled' package version 99.0.1 from all affected systems. Rotate all secrets and keys stored on the compromised computer from a separate, trusted device. Because full control may have been given to an attacker, further forensic analysis and remediation may be necessary to ensure complete removal of malicious software.

Summary

The package '@google-pay-trust/cancelled' version 99.0.1 on npm was detected by multiple sources, including Amazon Inspector, GHSA Malware, and the OpenSSF Package Analysis project, as containing malicious code. The package executes commands associated with malicious behavior, leading to a full compromise of any system where it is installed or running. Due to the nature of the compromise, attackers may have persistent control beyond just the presence of the package itself.

References

github.com/advisories/GHSA-468m-q27w-9r8c (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 27 Oct 2026, 01:09 UTC

Technical details

References

Community reviews