MalwarePublished 26 Jun 2026

js-price-client-node (npm) · Malicious Code

Affects js-price-client-nodeSource GCVE Database

Malicious package : remove js-price-client-node and rotate any secrets on hosts that installed it.

Data as of 26 Jun 2026, 22:34 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6503

What to do

Remove js-price-client-node from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmjs-price-client-node	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package js-price-client-node version 1.0.0 contains malicious code that exfiltrates environment variables from the user's .env file during installation. The package's postinstall script reads and parses the .env file, then sends the data to a concealed remote server using a base58-encoded URL split across two files. The exfiltration is stealthy, with errors suppressed and fake success responses returned to avoid detection. The package falsely claims to fetch cryptocurrency prices but performs no such function, instead harvesting sensitive credentials such as API keys and passwords.

Impact

Sensitive environment variables stored in .env files, which often include API keys, database passwords, cloud credentials, and signing secrets, are silently exfiltrated to an attacker-controlled server during installation of the affected package version. This can lead to compromise of user accounts, cloud resources, and other systems relying on these credentials.

Defensive guidance

Users should avoid installing js-price-client-node version 1.0.0. Review and remove this package from any projects where it has been installed. Rotate any credentials that may have been exposed through .env files used in conjunction with this package. Monitor for suspicious activity related to compromised credentials. Always verify the authenticity and reputation of npm packages before installation.

Summary

The js-price-client-node npm package (version 1.0.0) includes a postinstall script that executes a function named prices() which determines the project root directory, reads the .env file, parses it using dotenv, and sends the parsed key-value pairs as JSON to a remote URL. The destination URL is obfuscated by base58 encoding and split between two source files, then decoded at runtime. The upload operation suppresses errors to avoid alerting the user. The package metadata and README are deceptive, copying content from unrelated packages to disguise its true intent. This behavior constitutes credential exfiltration from the user's environment during package installation.

References

npmjs.com/package/js-price-client-node/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Jun 2026, 22:34 UTC

Technical details

References

Community reviews