@liauto/darwin-x64 (npm) · Malicious Code
Affects @liauto/darwin-x64Source GCVE Database
Malicious package : remove @liauto/darwin-x64 and rotate any secrets on hosts that installed it.
Data as of 29 Oct 2026, 18:35 UTC
Malicious package
Published to npm · OSV MAL-2026-18190
What to do
Remove @liauto/darwin-x64 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@liauto/darwin-x64 | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
@liauto/darwin-x64 version 0.1.1-b3 is a malicious npm package containing harmful code. Installation of this package can lead to full system compromise. It is recommended to remove the package and rotate all secrets and keys from a separate, uncompromised device.