@help-forms/application-aff (npm) · Malicious Code
Affects @help-forms/application-affSource GCVE Database
Malicious package : remove @help-forms/application-aff and rotate any secrets on hosts that installed it.
Data as of 26 Jun 2026, 22:36 UTC
Malicious package
Published to npm · OSV MAL-2026-6494
What to do
Remove @help-forms/application-aff from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@help-forms/application-aff | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package @help-forms/application-aff version 3.4.3 contains a malicious postinstall script that executes automatically upon installation. This script is heavily obfuscated and performs project fingerprinting to cache execution per project. It fetches a platform-specific binary from a hidden URL without verification and executes it as a detached background process. The package itself is a decoy with missing source files, causing runtime errors for legitimate API calls after the malicious code has already run. This behavior matches a supply-chain dropper pattern.