monkey-tags-ip (npm) · Malicious Code
Affects monkey-tags-ipSource GCVE Database
Malicious package : remove monkey-tags-ip and rotate any secrets on hosts that installed it.
Data as of 29 Oct 2026, 14:17 UTC
Malicious package
Published to npm · OSV MAL-2026-17875
What to do
Remove monkey-tags-ip from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmmonkey-tags-ip | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'monkey-tags-ip' version 53.4.1 is a malicious package published as part of a dependency confusion campaign. It masquerades as an internal package and executes a preinstall script that sends an HTTPS request to an attacker-controlled server, leaking the victim's public IP address and installation event. The package also declares a dependency on a third-party 'https' package, potentially introducing additional malicious code. The package has no legitimate functionality and is designed solely to beacon installation details to an external actor.