nicegui (npm) · Malicious Code
Affects niceguiSource GCVE Database
Malicious package : remove nicegui and rotate any secrets on hosts that installed it.
Data as of 27 Oct 2026, 00:07 UTC
Malicious package
Published to npm · OSV MAL-2026-3180
What to do
Remove nicegui from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmnicegui | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
Malicious npm package published by threat actor "ryanmccollum1" typosquatting the popular Python NiceGUI framework. Part of the same supply chain attack campaign as redeem-onchain-sdk, which collects SSH keys, AWS credentials, .npmrc tokens, Docker auth, Chrome saved logins, .env files, and git history, exfiltrating over a raw TCP socket to an AWS-hosted C2. Published by threat actor "ryanmccollum1" as part of the same campaign as redeem-onchain-sdk. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (bdc02f08ae75f2010d8b5df4b7b4f083b25f30e8d4c8b8aee4c5c1f988e416ed) The package nicegui was found to contain malicious code.