MalwarePublished 3 Jul 2026Updated 9 Jul 2026

@node-cloud/create (npm) · Malicious Code

Affects @node-cloud/createSource GCVE Database

Malicious package : remove @node-cloud/create and rotate any secrets on hosts that installed it.

Data as of 11 Jul 2026, 13:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6741

What to do

Remove @node-cloud/create from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@node-cloud/create	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @node-cloud/create includes a suspicious dependency @sql-trigger/nodesql that is imported but not used, indicating potential dependency smuggling. The main package acts as a wrapper for npm publishing functions but the sibling-scoped dependency may execute malicious code upon installation. Although the package itself does not contain install-time hooks or exfiltration code, the risk lies in the imported dependency which requires separate evaluation. Security sources warn that any system with this package installed should be considered fully compromised, recommending immediate secret rotation and package removal. No patch or fix is currently available.

Impact

Systems with @node-cloud/create installed or running are considered fully compromised. Attackers may have gained full control, risking exposure of all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious components or persistence mechanisms. Immediate secret rotation from a clean environment is required to mitigate credential exposure.

Defensive guidance

The recommended mitigation is to immediately remove the @node-cloud/create package from all affected systems. All secrets and keys stored on compromised systems should be rotated from a separate, trusted environment. Monitor for any signs of persistent compromise beyond the package installation.

Summary

The npm package @node-cloud/create unconditionally requires the @sql-trigger/nodesql package, which is unrelated in scope and purpose. This pattern suggests dependency smuggling, where the visible package is a facade to deliver a potentially malicious sibling-scoped package. The main package exposes npm publishing helper functions but does not itself perform malicious actions. The critical risk depends on the behavior of @sql-trigger/nodesql, which must be analyzed separately. Security advisories indicate that installation of this package likely results in full system compromise, necessitating secret rotation and removal of the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Jul 2026, 13:15 UTC

Technical details

References

Community reviews