ioredis-orm (npm) · Malicious Code
Affects ioredis-ormSource GCVE Database
Malicious package : remove ioredis-orm and rotate any secrets on hosts that installed it.
Data as of 9 Jul 2026, 09:54 UTC
Malicious package
Published to npm · OSV MAL-2026-5675
What to do
Remove ioredis-orm from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmioredis-orm | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'ioredis-orm' version 5.11.2 is a malicious package impersonating the legitimate 'ioredis' Redis client. While the package itself contains no direct malicious code, it declares a dependency on 'ioredis-typed', a separate package that is not part of the legitimate project and may carry malicious payloads. Installing 'ioredis-orm' can lead to supply-chain compromise through this transitive dependency. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems should be rotated from a secure environment.