MalwarePublished 12 Aug 2026

hxckdoeaqjlc8 (npm) · Malicious Code

Affects hxckdoeaqjlc8Source GCVE Database

Malicious package : remove hxckdoeaqjlc8 and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:45 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13816

What to do

Remove hxckdoeaqjlc8 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmhxckdoeaqjlc8	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'hxckdoeaqjlc8' version 1.0.0 contains a malicious HTML file that impersonates Cloudflare's 'Just a moment...' interstitial page. When the Turnstile widget callback triggers, embedded JavaScript redirects visitors to a phishing site 'https://checkout.microlive.club/', forwarding any query parameters. The package does not execute code on install or require, indicating it is designed to serve as a phishing landing page via npm's static hosting. Installing or running this package may lead to full system compromise, requiring immediate secret and key rotation and package removal.

Impact

The package facilitates phishing by redirecting users to a malicious site impersonating Cloudflare's interstitial page. Systems with this package installed or running are considered fully compromised, implying potential unauthorized access or control. Secrets and keys stored on affected systems may be exposed and must be rotated. Removal of the package alone may not guarantee full remediation due to possible additional malicious software installed.

Defensive guidance

Immediate removal of the 'hxckdoeaqjlc8' package version 1.0.0 is recommended. All secrets and keys on affected systems should be rotated from a separate, trusted device. Due to the risk of full system compromise, further forensic analysis and remediation may be necessary. Monitor for any signs of persistent malicious activity beyond the package itself.

Summary

The 'hxckdoeaqjlc8' npm package version 1.0.0 ships a single HTML file mimicking Cloudflare's interstitial page. Upon Turnstile widget callback, JavaScript reconstructs and redirects the browser to a phishing URL, forwarding query parameters. The package.json lacks lifecycle scripts and points 'main' to the HTML file, so no code executes during npm install or require. This artifact abuses the npm registry as static hosting for phishing, targeting browser visitors rather than developers. According to the GHSA-malware source, any system with this package installed or running should be considered fully compromised, necessitating secret/key rotation and package removal, though removal may not fully eliminate malicious presence.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:45 UTC

Technical details

References

Community reviews