@innocarpe/deepseek-build (npm) · Malicious Code
Affects @innocarpe/deepseek-buildSource GCVE Database
Malicious package : remove @innocarpe/deepseek-build and rotate any secrets on hosts that installed it.
Data as of 6 Aug 2026, 18:35 UTC
Malicious package
Published to npm · OSV MAL-2026-13420
What to do
Remove @innocarpe/deepseek-build from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@innocarpe/deepseek-build | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package @innocarpe/deepseek-build version 1.0.0 contains malicious code in its postinstall script that executes automatically upon installation. This script uses Node.js child_process to send POST requests containing environment and host identifier data, effectively performing install-time reconnaissance on the host system. This behavior is not part of any documented build process and represents unauthorized data exfiltration during package installation.