MalwarePublished 12 Aug 2026

jkbnwsdf8 (npm) · Malicious Code

Affects jkbnwsdf8Source GCVE Database

Malicious package : remove jkbnwsdf8 and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:45 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13818

What to do

Remove jkbnwsdf8 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmjkbnwsdf8	Affected =1.0.1 =1.0.0 =1.0.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'jkbnwsdf8' contains a single HTML file styled as a Cloudflare Turnstile challenge that executes obfuscated JavaScript to redirect browser users to a constructed URL. This redirect only triggers when the HTML is loaded via an npm CDN in a browser, not during package installation or require() in Node.js environments. The package abuses npm as a static-hosting CDN for redirect/cloaking purposes and does not execute code on the installer's machine. However, another source claims that any system with this package installed or running should be considered fully compromised, recommending immediate secret/key rotation and package removal. No official patch or remediation guidance is provided.

Impact

The package does not execute malicious code during installation or runtime in Node.js environments, so developers and build systems are not directly compromised by installing or requiring it. The malicious redirect affects only browser users who load the HTML via npm CDNs, potentially redirecting them to attacker-controlled URLs. According to one source, systems with this package installed or running may be fully compromised, implying potential for broader compromise beyond the redirect behavior, though this is not corroborated by the npm package structure. No known exploits in the wild are reported.

Defensive guidance

Since the package does not execute code during installation or require(), developers are not directly at risk from installing it. However, it is recommended to remove the package if installed and avoid loading its HTML content via npm CDNs in browsers. If the package has been run or is present on a system, consider rotating all secrets and keys from a different, trusted machine as a precautionary measure. The package should be reported for registry abuse and removed from use.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:45 UTC

Technical details

References

Community reviews