MalwarePublished 15 Jun 2026Updated 15 Jul 2026

ldpbootstrap-jquery (npm) · Malicious Code

Affects ldpbootstrap-jquerySource GCVE Database

Malicious package : remove ldpbootstrap-jquery and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:44 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5790

What to do

Remove ldpbootstrap-jquery from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmldpbootstrap-jquery	Affected 1.0.0 – 1.0.16 14 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The ldpbootstrap-jquery npm package contains malicious code that executes an obfuscated Windows PowerShell payload. This payload is decrypted and run with execution policy bypass and hidden window settings, explicitly designed to evade antivirus detection. The package also fetches additional PowerShell scripts over unencrypted HTTP, which are executed in the same stealthy manner. Although the malicious code does not run automatically on installation, any developer using the package as documented will execute attacker-controlled PowerShell code on Windows systems. This behavior constitutes malware distribution infrastructure and results in full compromise of affected systems.

Impact

Any system running this package and executing its documented API calls is fully compromised, allowing attackers to run arbitrary PowerShell code with stealth techniques that bypass execution policies and antivirus detection. This can lead to complete system takeover, exposure of stored secrets and keys, and persistent malware presence. Removal of the package alone does not guarantee eradication of all malicious components due to the level of control attackers gain.

Defensive guidance

The recommended mitigation is immediate removal of the ldpbootstrap-jquery package from all systems. All secrets and keys stored on compromised machines should be rotated from a separate, trusted device. Due to the full compromise risk, affected systems should be considered untrusted and thoroughly investigated for persistent malware beyond the package itself.

Summary

The ldpbootstrap-jquery package includes an 8KB encrypted PowerShell script that is decrypted using a hardcoded XOR key and executed on Windows endpoints with execution policy bypass and hidden windows to evade antivirus detection. Additionally, it fetches session-specific PowerShell scripts over plain HTTP from a configurable API endpoint, which are also executed stealthily. The package's README documents antivirus evasion techniques and the use of per-session XOR keys for delivery. The malicious payload execution is triggered through the package API, not automatically on install or require, but following documented usage. This design enables attackers to distribute malware and gain full control over affected computers.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 12:44 UTC

Technical details

References

Community reviews