lessload (npm) · Malicious Code
Affects lessloadSource GCVE Database
Malicious package : remove lessload and rotate any secrets on hosts that installed it.
Data as of 26 Oct 2026, 15:55 UTC
Malicious package
Published to npm · OSV MAL-2026-6579
What to do
Remove lessload from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmlessload | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The lessload@1.0.1 npm package impersonates the popular debug package and contains a backdoor in its enable() function. When enable() is called, it sends an HTTPS request to a hardcoded attacker-controlled endpoint, leaking the caller's namespace argument. The response includes base64-encoded code that is executed with full require access, allowing arbitrary code execution within the Node.js process. The malicious code is disguised as a legitimate debug feature. This package is a drop-in replacement for debug, so any code expecting debug semantics will trigger the backdoor upon calling enable().