MalwarePublished 31 May 2026Updated 1 Sep 2026

js-shared-modules (npm) · Malicious Code

Affects js-shared-modulesSource GCVE Database

Malicious package : remove js-shared-modules and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 15:02 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5098

What to do

Remove js-shared-modules from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmjs-shared-modules	Affected =1.11.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'js-shared-modules' version 1.11.7 is identified as malicious. It contains a postinstall script that executes automatically on npm install, which collects the installer's hostname, encodes it, and sends it to a third-party domain associated with malicious activity. The package has no legitimate functionality and is designed to exfiltrate host identity information. Installation of this package may lead to full compromise of the affected system.

Impact

Installation of this package results in exfiltration of the host's identity information to a malicious third party. According to the source, any computer with this package installed or running should be considered fully compromised, with potential exposure of secrets and keys stored on the system. Removal of the package does not guarantee elimination of all malicious software that may have been installed as a result.

Defensive guidance

The package should be immediately removed from any affected systems. All secrets and keys stored on compromised systems should be rotated from a different, trusted computer. Due to the potential full compromise, further forensic analysis and remediation may be necessary. Users should avoid installing this package and verify package authenticity before installation.

Summary

The 'js-shared-modules' npm package at version 1.11.7 includes a postinstall script that runs 'node poc.js' on installation. This script reads the system's hostname, hex-encodes it, and sends it via HTTPS GET request to a malicious domain (zcpesvvighyuzqlzkqgdydwp9jn54hfeg.oast.fun), effectively exfiltrating the installer's host identity. The package itself exports an empty module and is a dependency-confusion proof-of-concept squatting a generic internal package name. The OpenSSF Package Analysis project and other sources classify this package as malicious due to its communication with a domain linked to malicious activity. Any system with this package installed should be considered compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 15:02 UTC

Technical details

References

Community reviews