imgbundle (npm) · Malicious Code
Affects imgbundleSource GCVE Database
Malicious package : remove imgbundle and rotate any secrets on hosts that installed it.
Data as of 26 Oct 2026, 16:23 UTC
Malicious package
Published to npm · OSV MAL-2026-17330
What to do
Remove imgbundle from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmimgbundle | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'imgbundle' versions 1.0.0 and 1.0.1 contains malicious code that does not perform its advertised image bundling function. Instead, it decrypts an AES-256-CBC encrypted file from a sibling dependency 'cdn-img-fetch' using a hardcoded key, writes the decrypted content to disk, deletes the original encrypted file, and sets up a file watcher to repeat this process if the encrypted file reappears. This behavior effectively makes 'imgbundle' a staged dropper that materializes attacker-controlled content on the filesystem at import time, contrary to its stated purpose.