Malicious code in my-empty-package (npm)
The my-empty-package npm package version 1.0.0 contains malicious code that executes arbitrary platform-specific commands during installation. The install script runs different shell commands depending on the operating system, including obfuscated PowerShell commands on Windows, which is a common malware evasion technique. After execution, the package hides its malicious behavior by replacing the package manifest and deleting the install script, preventing detection. Although the current payload is benign (opening the calculator), the framework can execute any code with user privileges at install time, posing a serious risk.
AI Analysis
Technical Summary
The my-empty-package npm package version 1.0.0 includes a postinstall script that runs platform-specific shell commands on installation. It uses osascript on macOS, encoded PowerShell commands on Windows, and Python system calls on Linux. The script then overwrites package.json with a benign file and deletes itself to evade detection. This install-time remote code execution (RCE) mechanism allows arbitrary code execution with the installing user's privileges. The current payload is a harmless demonstration, but the delivery framework is fully capable of executing malicious payloads.
Potential Impact
This vulnerability enables arbitrary code execution during package installation with the privileges of the user running npm install. The malicious code can execute platform-specific commands, potentially leading to full system compromise. The anti-forensic behavior of manifest replacement and script deletion makes detection and forensic analysis difficult. Although no known exploits are reported in the wild, the capability for stealthy RCE poses a high risk to users installing this package version.
Mitigation Recommendations
No official patch or fix is currently available for my-empty-package version 1.0.0. Users should avoid installing this package version. Since this is a malicious package, the best mitigation is to remove it from any projects and block it from internal repositories or registries. Monitor for any updates from the package maintainers or npm security advisories for remediation. Exercise caution when installing packages from untrusted sources.
Malicious code in my-empty-package (npm)
Description
The my-empty-package npm package version 1.0.0 contains malicious code that executes arbitrary platform-specific commands during installation. The install script runs different shell commands depending on the operating system, including obfuscated PowerShell commands on Windows, which is a common malware evasion technique. After execution, the package hides its malicious behavior by replacing the package manifest and deleting the install script, preventing detection. Although the current payload is benign (opening the calculator), the framework can execute any code with user privileges at install time, posing a serious risk.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The my-empty-package npm package version 1.0.0 includes a postinstall script that runs platform-specific shell commands on installation. It uses osascript on macOS, encoded PowerShell commands on Windows, and Python system calls on Linux. The script then overwrites package.json with a benign file and deletes itself to evade detection. This install-time remote code execution (RCE) mechanism allows arbitrary code execution with the installing user's privileges. The current payload is a harmless demonstration, but the delivery framework is fully capable of executing malicious payloads.
Potential Impact
This vulnerability enables arbitrary code execution during package installation with the privileges of the user running npm install. The malicious code can execute platform-specific commands, potentially leading to full system compromise. The anti-forensic behavior of manifest replacement and script deletion makes detection and forensic analysis difficult. Although no known exploits are reported in the wild, the capability for stealthy RCE poses a high risk to users installing this package version.
Mitigation Recommendations
No official patch or fix is currently available for my-empty-package version 1.0.0. Users should avoid installing this package version. Since this is a malicious package, the best mitigation is to remove it from any projects and block it from internal repositories or registries. Monitor for any updates from the package maintainers or npm security advisories for remediation. Exercise caution when installing packages from untrusted sources.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10535
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a55ff6168715ace432f1b24
Added to database: 07/14/2026, 09:20:33 UTC
Last enriched: 07/14/2026, 09:32:25 UTC
Last updated: 07/24/2026, 08:25:00 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.