MalwarePublished 12 Aug 2026

ms_aidc_com_tw (npm) · Malicious Code

Affects ms_aidc_com_twSource GCVE Database

Malicious package : remove ms_aidc_com_tw and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:42 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13828

What to do

Remove ms_aidc_com_tw from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmms_aidc_com_tw	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package ms_aidc_com_tw (version 1.0.0) contains malicious code that impersonates a Microsoft-branded Taiwanese domain and serves a fake Cloudflare Turnstile security verification page. Upon user interaction, it executes heavily obfuscated JavaScript to redirect victims to the legitimate Microsoft login page with attacker-controlled parameters, enabling OAuth-consent phishing. Installing or running this package may fully compromise the affected computer, risking exposure of stored secrets and keys.

Impact

Any system with this package installed or running should be considered fully compromised. The attacker may gain access to Microsoft 365 credentials through OAuth-consent phishing, potentially leading to unauthorized access to sensitive accounts and data. All secrets and keys stored on the compromised system should be considered exposed and require immediate rotation. Removal of the package alone does not guarantee elimination of all malicious software or attacker persistence.

Defensive guidance

Remove the ms_aidc_com_tw package immediately if installed. Rotate all secrets, credentials, and keys stored on the affected system from a separate, trusted device. Because full compromise is likely, conduct a thorough investigation and consider rebuilding the affected system to ensure removal of any persistent malicious components. Avoid installing packages from untrusted sources and verify package authenticity before use.

Summary

The ms_aidc_com_tw npm package (version 1.0.0) is a malicious package that hosts only an index.html page rendering a fake Cloudflare Turnstile verification. The obfuscated JavaScript collects query parameters and redirects users to login.microsoftonline.com with these parameters preserved, facilitating an adversary-in-the-middle OAuth-consent phishing attack. The package name mimics a legitimate Microsoft Taiwanese corporate domain to deceive users. This abuse of the npm registry serves as hosting infrastructure for Microsoft 365 credential harvesting. The obfuscation techniques include rotating string arrays, RC4/base64 decoding, and anti-debugging measures to conceal the phishing logic.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:42 UTC

Technical details

References

Community reviews