node-array-plus (npm) · Malicious Code
Affects node-array-plusSource GCVE Database
Malicious package : remove node-array-plus and rotate any secrets on hosts that installed it.
Data as of 5 Aug 2026, 17:04 UTC
Malicious package
Published to npm · OSV MAL-2026-11142
What to do
Remove node-array-plus from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmnode-array-plus | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The node-array-plus npm package versions 1.0.9 and 1.1.9 contain malicious code that executes remote payloads upon import. The package is heavily obfuscated and, when required, contacts a hardcoded IPv4 address to download an AES-256-CBC encrypted payload, which it decrypts and executes on the local machine. The package exposes no legitimate functionality and is designed solely to drop and run remote code stealthily.