index-ulid (npm) · Malicious Code
Affects index-ulidSource GCVE Database
Malicious package : remove index-ulid and rotate any secrets on hosts that installed it.
Data as of 12 Sep 2026, 19:46 UTC
Malicious package
Published to npm · OSV MAL-2026-5827
What to do
Remove index-ulid from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmindex-ulid | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'index-ulid' is a malicious typosquatting package impersonating legitimate ULID generators. Its postinstall script drops a persistent backdoor disguised as a Microsoft system component, installs persistence mechanisms across Windows, macOS, and Linux, and runs a long-running command-and-control agent that communicates with remote services. The package includes sandbox evasion techniques to avoid detection in low-CPU environments. This behavior is unjustified for a ULID library and indicates full system compromise upon installation.