MalwarePublished 26 Jun 2026

hexo-shoka-swiper (npm) · Malicious Code

Affects hexo-shoka-swiperSource GCVE Database

Malicious package : remove hexo-shoka-swiper and rotate any secrets on hosts that installed it.

Data as of 26 Jun 2026, 22:29 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6492

What to do

Remove hexo-shoka-swiper from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmhexo-shoka-swiper	Affected =0.1.10	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package hexo-shoka-swiper version 0.1.10 contains malicious code embedded in its binding.gyp file. This file uses GYP command-expansion syntax to execute arbitrary shell commands during installation via npm, leading to automatic execution of malicious code on the installer's machine. The package's intended function as a Hexo theme Swiper integration does not justify such behavior, indicating deliberate misuse of the build process to run unauthorized code. Installing this package can result in full system compromise, requiring immediate secret and key rotation and removal of the package, though complete remediation is not guaranteed due to potential persistent compromise.

Impact

Systems that install hexo-shoka-swiper version 0.1.10 are subject to arbitrary code execution during installation, resulting in full compromise of the affected computer. Attackers may gain complete control, potentially accessing all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious artifacts or backdoors, necessitating secret/key rotation and comprehensive incident response.

Defensive guidance

The recommended mitigation is to immediately remove hexo-shoka-swiper version 0.1.10 from all systems. Additionally, all secrets and keys stored on affected machines should be rotated from a secure, uncompromised environment. Due to the potential for persistent compromise, further forensic analysis and remediation may be required. Avoid installing this package and audit dependencies to prevent inclusion of this malicious version.

Summary

The hexo-shoka-swiper npm package version 0.1.10 includes a binding.gyp file that leverages GYP command-expansion syntax (<!(...)) to execute shell commands during the npm install process. Since npm automatically runs node-gyp rebuild when binding.gyp is present, this causes arbitrary shell code execution on the installer's machine without any declared install scripts. This behavior is malicious because the package's legitimate functionality as a front-end theme integration does not require native build steps or shell execution. The binding.gyp file is effectively used as a lifecycle hook to run arbitrary code, leading to full compromise of any system that installs this package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Jun 2026, 22:29 UTC

Technical details

References

Community reviews