MalwarePublished 12 Aug 2026

nhdxzthponv5 (npm) · Malicious Code

Affects nhdxzthponv5Source GCVE Database

Malicious package : remove nhdxzthponv5 and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:42 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13829

What to do

Remove nhdxzthponv5 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnhdxzthponv5	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package nhdxzthponv5@1.0.0 is a malicious artifact that hosts a phishing page impersonating Cloudflare Turnstile's challenge. It contains heavily obfuscated JavaScript that redirects users to a malicious '.cloud.homes' domain, forwarding query parameters to facilitate phishing or redirection attacks. The package does not provide any legitimate library functionality and is used solely to host malicious browser-targeted content via npm's public CDN. Installation or execution of this package can lead to full system compromise.

Impact

End users who access the package's CDN URL are redirected to a malicious domain, potentially exposing them to phishing attacks. Systems that have this package installed or running may be fully compromised, risking exposure of all stored secrets and keys. The malicious code can lead to unauthorized control over the affected computer, and simply removing the package may not eliminate all malicious artifacts.

Defensive guidance

Remove the nhdxzthponv5 package immediately from any system. Rotate all secrets and keys stored on affected computers from a secure, uncompromised device. Because the package may have granted full control to an attacker, assume full compromise and perform thorough incident response and system remediation.

Summary

The npm package nhdxzthponv5@1.0.0 is identified as malicious. It has a random name and lacks typical metadata such as description, author, repository, dependencies, or lifecycle scripts. Its main file is an HTML page that mimics the Cloudflare Turnstile 'Just a moment...' challenge using a real sitekey but a fake Ray ID. The embedded JavaScript is heavily obfuscated and includes anti-debugging techniques. Upon the Turnstile callback, it constructs a URL on a '.cloud.homes' domain, forwarding the current page's query parameters, and redirects the browser to that URL. This package is not intended for npm consumers but rather abuses npm's registry and CDN to host phishing content. Any system with this package installed or running should be considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:42 UTC

Technical details

References

Community reviews