MalwarePublished 4 Aug 2026Updated 6 Aug 2026

hubert-application-get-document-preview-am (npm) · Malicious Code

Affects hubert-application-get-document-preview-amSource GCVE Database

Malicious package : remove hubert-application-get-document-preview-am and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:28 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-11540

What to do

Remove hubert-application-get-document-preview-am from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmhubert-application-get-document-preview-am	Affected =20.4.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'hubert-application-get-document-preview-am' version 20.4.6 contains malicious code that downloads and executes a native binary from hardcoded external endpoints. It uses obfuscation techniques such as runtime hostname reconstruction and a DNS-TXT fallback channel to evade detection. The payload is written to temporary directories with deceptive filenames, given executable permissions, and executed detached from the main process. A secondary dropper in the package provides an alternate execution path. Any system with this package installed should be considered fully compromised, and all secrets on that system should be rotated immediately.

Impact

Any computer with this package installed or running is considered fully compromised. The attacker gains the ability to execute arbitrary native code on the host, potentially leading to complete system takeover. All secrets, keys, and sensitive information stored on the compromised system are at risk and should be rotated immediately from a secure environment. Removal of the package alone does not guarantee elimination of all malicious artifacts or backdoors introduced by the payload.

Defensive guidance

Immediate removal of the 'hubert-application-get-document-preview-am' package version 20.4.6 is recommended. All secrets and credentials stored on the affected system should be rotated from a different, trusted machine. Due to the nature of the compromise, a full system forensic analysis and potential reimaging may be necessary to ensure complete remediation. Avoid using this package and audit dependencies for similar malicious inclusions.

Summary

This malicious npm package, identified as 'hubert-application-get-document-preview-am' version 20.4.6, contains code that upon require() loads a setup script which selects a platform key and downloads a native binary from one of four hardcoded workers.dev endpoints. It uses a DNS-TXT fallback channel over *.well1.site domains to covertly receive base64-encoded payload chunks when HTTPS is blocked. The payload is saved to temporary directories under deceptive names, permissions are set to executable, and it is spawned detached via shell commands. The package also includes a second self-contained dropper in lib/telemetry.js that duplicates this behavior, providing an alternate execution path. No integrity verification of the downloaded payload is performed, and the external endpoints are unrelated to any legitimate package publisher. This results in full compromise of any host running the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:28 UTC

Technical details

References

Community reviews