MalwarePublished 12 Aug 2026

jhkxcixudnvm1 (npm) · Malicious Code

Affects jhkxcixudnvm1Source GCVE Database

Malicious package : remove jhkxcixudnvm1 and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:45 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13817

What to do

Remove jhkxcixudnvm1 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmjhkxcixudnvm1	Affected =1.0.1 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'jhkxcixudnvm1' versions 1.0.0 and 1.0.1 contains a malicious HTML file that impersonates a Cloudflare verification page and redirects users to a potentially harmful destination URL. The package does not execute JavaScript during installation or when required in code, so it does not directly compromise build systems or installers. However, if the package contents are served and accessed via a browser (e.g., through a CDN), end-users could be redirected to phishing or malicious sites. The package represents registry abuse rather than a traditional supply-chain code execution vulnerability.

Impact

End-users who access the package's index.html in a browser context (such as through a CDN serving package contents) may be redirected to a malicious site impersonating Cloudflare, potentially leading to phishing or other harm. There is no direct impact on systems that merely install or require the package in code, as no code execution or credential theft occurs during these operations. However, the presence of this package in an environment may indicate registry abuse and potential exposure to phishing attacks if the malicious HTML is served to users.

Defensive guidance

Since the malicious behavior only occurs if the package's HTML content is served and accessed in a browser, remediation should focus on registry abuse takedown procedures rather than supply-chain blocking. Removing the package from the registry and preventing its distribution via CDNs or other web-serving mechanisms is recommended. There is no need for supply-chain mitigations such as blocking installs or builds, as the package does not execute malicious code during installation or runtime. Users should avoid opening package contents in a browser and review any CDN or package content serving configurations to prevent exposure.

Summary

The 'jhkxcixudnvm1' npm package includes only a package.json and an index.html file declared as the main entry point. The index.html mimics a Cloudflare 'Just a moment...' interstitial page and contains obfuscated JavaScript that reconstructs and redirects to a destination URL after a short delay, forwarding query parameters. No JavaScript runs during npm install or when requiring the package, so the malicious behavior only manifests if the HTML is opened in a browser. This is a case of npm registry abuse hosting a phishing/redirect page, which could harm end-users if the package content is served via a web context. The package does not directly compromise the installer's environment or exfiltrate data during installation.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:45 UTC

Technical details

References

Community reviews