MalwarePublished 28 Sep 2026Updated 29 Sep 2026

native-runner (npm) · Malicious Code

Affects native-runnerSource GCVE Database

Malicious package : remove native-runner and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:22 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17218

What to do

Remove native-runner from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnative-runner	Affected 1.0.0 – 1.0.3 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'native-runner' contains malicious code that, upon import, silently waits for and executes a hidden binary named node_runtime_helper.exe from a Windows system-like directory. This behavior occurs as a side effect of requiring the package, without any explicit API call. The package depends on 'img-to-native', which places the malicious binary on the system. This drop-and-execute chain can lead to full system compromise, and removal of the package does not guarantee eradication of the malware.

Impact

Any system with 'native-runner' installed or running is considered fully compromised. The attacker gains persistent, hidden execution capabilities via the dropped binary. All secrets and keys stored on the compromised machine should be considered exposed and must be rotated immediately from a secure environment. Simply removing the package does not guarantee removal of all malicious components or persistence mechanisms.

Defensive guidance

Remove the 'native-runner' package immediately. Rotate all secrets and keys stored on the affected machine from a different, trusted device. Conduct a thorough system investigation and remediation, as the malicious binary runs detached and hidden and may have established persistence or additional backdoors. Avoid installing or importing this package.

Summary

The 'native-runner' npm package includes a top-level immediately-invoked function expression (IIFE) in its index.js that polls for up to two minutes for a binary file at %APPDATA%\Microsoft\Windows\node_runtime_helper.exe. Once detected, it launches this binary detached and hidden, allowing the process to run without user visibility or output capture. The package's only declared dependency, 'img-to-native@^1.0.0', is not used in code but is responsible for placing the malicious binary at the hardcoded path. Together, these packages form a drop-and-execute malware chain that compromises any system where 'native-runner' is installed or imported.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Sep 2026, 04:46 UTC

Technical details

References

Community reviews