MalwarePublished 9 Jun 2026Updated 1 Sep 2026

kraken-ui (npm) · Malicious Code

Affects kraken-uiSource GCVE Database

Malicious package : remove kraken-ui and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 16:03 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5399

What to do

Remove kraken-ui from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmkraken-ui	Affected =999.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The kraken-ui npm package version 999.0.0 contains malicious code that exfiltrates sensitive host and user information to an attacker-controlled server upon loading. This package is a dependency confusion attack proof of concept, published publicly to override an internal package of the same name. Installing or running this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.

Impact

Any system that installs or runs kraken-ui version 999.0.0 is considered fully compromised. The malicious package leaks sensitive host and user information to an attacker-controlled server, potentially exposing internal DNS topology and environment details. This can lead to unauthorized access and control over the affected system. All secrets and keys stored on the compromised system should be rotated immediately from a separate, trusted machine. Removing the package alone may not eliminate all malicious artifacts or backdoors installed as a result of this compromise.

Defensive guidance

Immediate removal of kraken-ui version 999.0.0 from all systems is required. Rotate all secrets and keys that may have been exposed, using a different, uncompromised system. Review internal package resolution configurations to prevent dependency confusion attacks by ensuring internal packages are not overridden by public registry versions. Monitor for any signs of persistent compromise and consider full system reimaging if necessary.

Summary

The kraken-ui package version 999.0.0 is a malicious npm package designed as a dependency confusion proof of concept. When loaded, its main entry point imports several modules and collects sensitive information including hostname, username, home directory, installation path, DNS servers, and full package.json contents. It then sends this data via HTTPS POST to an attacker-controlled out-of-band server. This behavior triggers automatically upon module load, potentially leaking internal system and network information. The package is published to the public npm registry to override an internal package, enabling attackers to capture identifying information from systems that resolve this version.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 16:03 UTC

Technical details

References

Community reviews