MalwarePublished 12 Aug 2026

hngfykuvgh4 (npm) · Malicious Code

Affects hngfykuvgh4Source GCVE Database

Malicious package : remove hngfykuvgh4 and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:45 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13815

What to do

Remove hngfykuvgh4 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmhngfykuvgh4	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'hngfykuvgh4' version 1.0.0 is a malicious artifact that impersonates a Cloudflare verification page using an obfuscated script to redirect visitors to a hidden destination URL. It does not execute code during installation or import, abusing the npm registry as static hosting for a phishing or redirect lure. While it is not a supply-chain attack against developers' build systems, any computer with this package installed should be considered fully compromised, requiring immediate secret and key rotation and package removal.

Impact

The package acts as a phishing or redirect lure by impersonating a trusted Cloudflare page and redirecting visitors to an obfuscated destination URL. Although it does not execute code during installation or import, its presence on a system indicates potential full compromise, as it may have been used to deliver or facilitate further malicious activity. Secrets and keys stored on affected systems are at risk and should be rotated immediately. The package abuse does not represent a direct supply-chain attack on developers but poses a significant risk to end users and systems where it is installed.

Defensive guidance

Remove the 'hngfykuvgh4' package immediately from any affected systems. Rotate all secrets and keys stored on compromised computers from a separate, trusted system. Since the package does not execute code during installation or import, focus on cleaning any additional malware or backdoors that may have been installed as a result of this package. Monitor for any suspicious redirects or phishing activity related to this package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:45 UTC

Technical details

References

Community reviews