MalwarePublished 5 Aug 2026Updated 14 Aug 2026

nolimit-agent (npm) · Malicious Code

Affects nolimit-agentSource GCVE Database

Malicious package : remove nolimit-agent and rotate any secrets on hosts that installed it.

Data as of 14 Aug 2026, 16:47 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12183

What to do

Remove nolimit-agent from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnolimit-agent	Affected 1.0.299 – 1.0.346 47 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'nolimit-agent' is a malicious toolkit designed for mass-mail and SMS spam campaigns, including phishing. It uses heavy JavaScript obfuscation to evade detection and includes features such as bulk SMTP sending, SMS via carrier email gateways, and contact harvesting via OAuth flows against Microsoft and Google APIs. The package collects OAuth tokens locally and uses them to enumerate contacts for spam targeting. It also performs license verification over unencrypted HTTP. Installing or running this package compromises the host machine, turning it into a platform for outbound abuse. Removal of the package does not guarantee full remediation due to potential persistent compromise.

Impact

Systems with 'nolimit-agent' installed or running are fully compromised, as the package enables mass spam and phishing campaigns using the victim's machine and accounts. OAuth tokens harvested locally can be used to access contacts and prior recipients for further abuse. The package's obfuscation and evasion techniques hinder detection and removal. Secrets and keys stored on the compromised system should be rotated immediately from a clean environment. Removal of the package alone may not eliminate all malicious components or control established by the attacker.

Defensive guidance

The package should be removed immediately. Due to the high likelihood of full system compromise, all secrets and keys stored on the affected machine must be rotated from a separate, trusted device. Incident response should assume complete compromise of the host. Monitor for any signs of persistent malicious activity and consider rebuilding the affected system from a known good state.

Summary

The 'nolimit-agent' npm package is a weaponized spam and phishing toolkit distributed with obfuscated JavaScript code to evade detection. It supports bulk SMTP and SMS sending, scanner evasion techniques including obfuscated HTML attachments and SVG-based payload delivery, and DKIM key generation. The package implements OAuth device-code flows against Microsoft and Google to harvest contacts from Microsoft Graph and Google People APIs, storing tokens locally without relaying them to the attacker. It performs license checks via unencrypted HTTP requests. The Windows postinstall script is benign and does not perform network activity. The package does not exfiltrate installer secrets on installation but enables the installer's machine and accounts to be abused for outbound spam and phishing. The obfuscation is designed to defeat registry scanning. Any system with this package installed or running should be considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 16:47 UTC

Technical details

References

Community reviews