MalwarePublished 13 Jul 2026Updated 1 Sep 2026

ishowfeet14 (npm) · Malicious Code

Affects ishowfeet14Source GCVE Database

Malicious package : remove ishowfeet14 and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 17:32 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10316

What to do

Remove ishowfeet14 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmishowfeet14	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'ishowfeet14' contains malicious code that facilitates mass publication of nearly 100 similarly named packages by rewriting package names and republishing automatically. It includes a browser Service Worker that serves a heavily obfuscated web proxy frontend with a hidden popunder redirect to a malicious site. The package does not execute code during Node.js installation, so the compromise occurs only when the browser loads the static assets, resulting in registry abuse and browser-side malicious behavior. The package is flagged for namespace abuse and considered critical due to potential full system compromise if installed.

Impact

Installing or running this package can lead to full system compromise, as indicated by the source advisory. All secrets and keys on the affected computer should be considered compromised and rotated immediately. The primary harm is registry namespace abuse and browser-side malicious proxy and redirect behavior. Node.js environments do not experience auto-execution during installation, but the browser assets serve malicious content when loaded. The package poses a critical risk to affected systems.

Defensive guidance

The package should be removed immediately from any affected systems. All secrets and keys stored on compromised computers must be rotated from a different, clean system. Since the package grants potential full control to an attacker, removal alone may not fully remediate the compromise. Namespace abuse is being routed for human review. Users should avoid installing or running this package or any similarly named variants.

Summary

The 'ishowfeet14' npm package contains a script 'auto-publish.sh' that automates republishing the same payload under approximately 100 different npm package names by modifying 'package.json.name' and running 'npm publish' in a loop, constituting namespace spam. Its declared main entry is a browser Service Worker script that loads obfuscated web proxy assets themed as 'Riverbend Tutoring' and triggers a popunder redirect to 'https://abdct.com/'. The package does not execute code during Node.js installation, preventing installer-side compromise, but any system running or installing the package is considered fully compromised due to the malicious browser-side payload. The package abuse is primarily registry namespace spam and browser-based malicious redirection.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 17:32 UTC

Technical details

References

Community reviews