MalwarePublished 20 May 2026Updated 9 Jul 2026

nolimit-x (npm) · Malicious Code

Affects nolimit-xSource GCVE Database

Malicious package : remove nolimit-x and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 09:29 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-4621

What to do

Remove nolimit-x from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnolimit-x	Affected 1.0.194 – 1.0.294 41 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (92a244ab5171edadc3082bc97d5b0834c4cfe98f2e5b6437503a30a7c1ac38aa) nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no readable source, and devDependencies + the build script confirm the obfuscation is intentional (`build: node scripts/obfuscate.js`, `javascript-obfuscator` in devDependencies). The decoded entrypoint exposes a CLI offensive toolkit: a `send` subcommand for bulk SMS via SMTP-to-carrier email gateways and bulk email; an `auth` subcommand performing OAuth device-code flows against Microsoft and Google to obtain SMTP + Microsoft Graph credentials; an `extract` subcommand that reads a victim mailbox's contacts via Graph + IMAP and writes them to disk; a `web` subcommand that injects a sending panel into a logged-in Chrome webmail tab; a `dkim` subcommand that generates DKIM keys for arbitrary sender domains; and `scan-redirects`. README markets it as an "Advanced email sender" with keywords including "red-team" and "smtp". A hardcoded license check (`http://api.nolimitent.xyz:4100/api/activate`) POSTs hardware ID, license key, hostname, and platform in cleartext when the operator runs license-gated subcommands. main and bin both point at.ad/x0.js, which calls program.parse() at module top level — a consumer that require()s the package will run commander against the consumer's process.argv (no network fires until argv matches a subcommand, but the library/CLI conflation plus pervasive obfuscation make pre-install audit infeasible). The package is a packaged phishing/spam/credential-phishing toolkit dressed as an npm library; installer-side harm is bounded (no auto-exfil at install or import), but the package's purpose is to enable attacks on third parties (mailbox owners, SMS recipients, OAuth account holders), and the obfuscation defeats normal supply-chain audit. ## Source: ghsa-malware (ccf60ba7ea5c4024535d8fb6006c06a6dc0c2bcd9f617d93f9f4bc07386f609b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Impact

Systems with nolimit-x installed or running are considered fully compromised. Attackers can leverage the package to send bulk spam and phishing messages, harvest OAuth credentials from Microsoft and Google accounts, extract mailbox contacts, and manipulate webmail interfaces. The package's presence risks exposure of sensitive credentials and system information. Because the package enables active attacks on third parties and compromises the host, the impact is severe. Removal of the package does not guarantee full remediation due to potential persistence mechanisms.

Defensive guidance

Immediate removal of the package from all affected systems is recommended. Due to the high risk of full system compromise, all secrets, credentials, and keys stored on affected machines should be rotated from a separate, trusted environment. Monitor for any signs of persistence or additional malicious software installed alongside nolimit-x. Exercise caution with packages that use heavy obfuscation and conduct thorough audits before installation.

Summary

The npm package nolimit-x ships with heavily obfuscated runtime code and exposes a command-line interface that enables bulk SMS and email sending, OAuth-based credential harvesting, mailbox contact extraction, and webmail interface manipulation. It includes a hardcoded license activation check that leaks system identifiers in cleartext. The package is effectively a phishing and spam toolkit disguised as a legitimate npm library. Its obfuscation prevents effective pre-install auditing, and its use results in full compromise of the host system. Removal of the package alone may not eliminate all malicious components, and all secrets on affected systems should be rotated. The package affects multiple exact versions listed, with no known patch or remediation available.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 9 Jul 2026, 09:54 UTC

Technical details

References

Community reviews