MalwarePublished 28 Sep 2026Updated 30 Sep 2026

my-skibidi (npm) · Malicious Code

Affects my-skibidiSource GCVE Database

Malicious package : remove my-skibidi and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:22 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17217

What to do

Remove my-skibidi from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmmy-skibidi	Affected 1.0.0 – 1.1.6 9 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package my-skibidi (versions 1.0.0 through 1.1.6) contains malicious code that unconditionally sends users' browser cookies to a hardcoded external server. This exfiltration occurs immediately upon loading the module without user consent or configuration options. The package's declared functionality does not require cookie access or transmission. Any application bundling this package risks leaking session data to an unauthorized third party. Removal of the package is recommended, but full system compromise is possible, necessitating secret and key rotation from a clean environment.

Impact

Users of web applications that include the my-skibidi package risk having their session cookies and potentially sensitive session data exfiltrated to an attacker-controlled external server. This can lead to session hijacking and unauthorized access to user accounts. The compromise extends to any computer with the package installed or running, potentially allowing attackers full control over the system. Secrets and keys stored on affected systems should be considered compromised and rotated immediately.

Defensive guidance

Remove the my-skibidi package from all projects and systems immediately. Rotate all secrets, keys, and credentials that may have been exposed due to the compromise from a separate, trusted environment. Because the package may have allowed full system compromise, conduct a thorough security assessment and consider rebuilding affected systems. There is no indication of an official patch or fix; therefore, avoid using this package entirely.

Summary

The my-skibidi npm package versions 1.0.0 through 1.1.6 include top-level code in the main module that automatically posts the user's document.cookie to a fixed external URL (https://c-b34596407b6d47d6.dgactf-challs.site/addPost) via a sendPost call. This behavior is unconditional and not configurable by the user or application. The package's intended functionality does not require cookie access or transmission, indicating malicious intent. Any web application that bundles this package will leak session cookies to an attacker-controlled endpoint when loaded in a user's browser. The package should be considered fully compromised, and systems with it installed may be fully compromised as well.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Sep 2026, 04:58 UTC

Technical details

References

Community reviews