MalwarePublished 28 Sep 2026

kalasnik-npm-simple-test (npm) · Malicious Code

Affects kalasnik-npm-simple-testSource GCVE Database

Malicious package : remove kalasnik-npm-simple-test and rotate any secrets on hosts that installed it.

Data as of 29 Sep 2026, 04:58 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17206

What to do

Remove kalasnik-npm-simple-test from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmkalasnik-npm-simple-test	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'kalasnik-npm-simple-test' version 1.0.0 contains malicious code that executes during installation. Its postinstall script reads a local file and sends its contents over unencrypted HTTP to a remote server, indicating data exfiltration. Installation of this package compromises the host system, potentially exposing all stored secrets and keys.

Impact

Systems that install this package are at high risk of data exfiltration, as the postinstall script sends local file contents to an attacker-controlled server. This compromises confidentiality and potentially integrity of the host system. The presence of this package indicates a full compromise, and all secrets and keys stored on the system should be considered exposed and rotated immediately.

Defensive guidance

Remove the 'kalasnik-npm-simple-test' package immediately. Rotate all secrets and keys from a separate, uncompromised system. Because the package grants potential full control to an attacker, simply removing it may not fully remediate the compromise; a full system investigation and potential rebuild is recommended.

Summary

The 'kalasnik-npm-simple-test' npm package version 1.0.0 includes a postinstall script named send_data.js that automatically runs on npm install. This script reads the file C:\temp\test.txt from the installer's filesystem and transmits its contents via plain HTTP to a hardcoded remote endpoint at IP 35.178.197.251 on port 8080. The package metadata suggests it is a proof-of-concept exfiltration tool rather than a legitimate library. Due to this behavior, any system with this package installed should be considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Sep 2026, 04:58 UTC

Technical details

References

Community reviews