Malicious code in nolimit-x (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (92a244ab5171edadc3082bc97d5b0834c4cfe98f2e5b6437503a30a7c1ac38aa) nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no readable source, and devDependencies + the build script confirm the obfuscation is intentional (`build: node scripts/obfuscate.js`, `javascript-obfuscator` in devDependencies). The decoded entrypoint exposes a CLI offensive toolkit: a `send` subcommand for bulk SMS via SMTP-to-carrier email gateways and bulk email; an `auth` subcommand performing OAuth device-code flows against Microsoft and Google to obtain SMTP + Microsoft Graph credentials; an `extract` subcommand that reads a victim mailbox's contacts via Graph + IMAP and writes them to disk; a `web` subcommand that injects a sending panel into a logged-in Chrome webmail tab; a `dkim` subcommand that generates DKIM keys for arbitrary sender domains; and `scan-redirects`. README markets it as an "Advanced email sender" with keywords including "red-team" and "smtp". A hardcoded license check (`http://api.nolimitent.xyz:4100/api/activate`) POSTs hardware ID, license key, hostname, and platform in cleartext when the operator runs license-gated subcommands. main and bin both point at.ad/x0.js, which calls program.parse() at module top level — a consumer that require()s the package will run commander against the consumer's process.argv (no network fires until argv matches a subcommand, but the library/CLI conflation plus pervasive obfuscation make pre-install audit infeasible). The package is a packaged phishing/spam/credential-phishing toolkit dressed as an npm library; installer-side harm is bounded (no auto-exfil at install or import), but the package's purpose is to enable attacks on third parties (mailbox owners, SMS recipients, OAuth account holders), and the obfuscation defeats normal supply-chain audit. ## Source: ghsa-malware (ccf60ba7ea5c4024535d8fb6006c06a6dc0c2bcd9f617d93f9f4bc07386f609b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The npm package nolimit-x ships with heavily obfuscated runtime code and exposes a command-line interface that enables bulk SMS and email sending, OAuth-based credential harvesting, mailbox contact extraction, and webmail interface manipulation. It includes a hardcoded license activation check that leaks system identifiers in cleartext. The package is effectively a phishing and spam toolkit disguised as a legitimate npm library. Its obfuscation prevents effective pre-install auditing, and its use results in full compromise of the host system. Removal of the package alone may not eliminate all malicious components, and all secrets on affected systems should be rotated. The package affects multiple exact versions listed, with no known patch or remediation available.
Potential Impact
Systems with nolimit-x installed or running are considered fully compromised. Attackers can leverage the package to send bulk spam and phishing messages, harvest OAuth credentials from Microsoft and Google accounts, extract mailbox contacts, and manipulate webmail interfaces. The package's presence risks exposure of sensitive credentials and system information. Because the package enables active attacks on third parties and compromises the host, the impact is severe. Removal of the package does not guarantee full remediation due to potential persistence mechanisms.
Mitigation Recommendations
No official patch or fix is available for nolimit-x. Immediate removal of the package from all affected systems is recommended. Due to the high risk of full system compromise, all secrets, credentials, and keys stored on affected machines should be rotated from a separate, trusted environment. Monitor for any signs of persistence or additional malicious software installed alongside nolimit-x. Exercise caution with packages that use heavy obfuscation and conduct thorough audits before installation.
Malicious code in nolimit-x (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (92a244ab5171edadc3082bc97d5b0834c4cfe98f2e5b6437503a30a7c1ac38aa) nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no readable source, and devDependencies + the build script confirm the obfuscation is intentional (`build: node scripts/obfuscate.js`, `javascript-obfuscator` in devDependencies). The decoded entrypoint exposes a CLI offensive toolkit: a `send` subcommand for bulk SMS via SMTP-to-carrier email gateways and bulk email; an `auth` subcommand performing OAuth device-code flows against Microsoft and Google to obtain SMTP + Microsoft Graph credentials; an `extract` subcommand that reads a victim mailbox's contacts via Graph + IMAP and writes them to disk; a `web` subcommand that injects a sending panel into a logged-in Chrome webmail tab; a `dkim` subcommand that generates DKIM keys for arbitrary sender domains; and `scan-redirects`. README markets it as an "Advanced email sender" with keywords including "red-team" and "smtp". A hardcoded license check (`http://api.nolimitent.xyz:4100/api/activate`) POSTs hardware ID, license key, hostname, and platform in cleartext when the operator runs license-gated subcommands. main and bin both point at.ad/x0.js, which calls program.parse() at module top level — a consumer that require()s the package will run commander against the consumer's process.argv (no network fires until argv matches a subcommand, but the library/CLI conflation plus pervasive obfuscation make pre-install audit infeasible). The package is a packaged phishing/spam/credential-phishing toolkit dressed as an npm library; installer-side harm is bounded (no auto-exfil at install or import), but the package's purpose is to enable attacks on third parties (mailbox owners, SMS recipients, OAuth account holders), and the obfuscation defeats normal supply-chain audit. ## Source: ghsa-malware (ccf60ba7ea5c4024535d8fb6006c06a6dc0c2bcd9f617d93f9f4bc07386f609b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The npm package nolimit-x ships with heavily obfuscated runtime code and exposes a command-line interface that enables bulk SMS and email sending, OAuth-based credential harvesting, mailbox contact extraction, and webmail interface manipulation. It includes a hardcoded license activation check that leaks system identifiers in cleartext. The package is effectively a phishing and spam toolkit disguised as a legitimate npm library. Its obfuscation prevents effective pre-install auditing, and its use results in full compromise of the host system. Removal of the package alone may not eliminate all malicious components, and all secrets on affected systems should be rotated. The package affects multiple exact versions listed, with no known patch or remediation available.
Potential Impact
Systems with nolimit-x installed or running are considered fully compromised. Attackers can leverage the package to send bulk spam and phishing messages, harvest OAuth credentials from Microsoft and Google accounts, extract mailbox contacts, and manipulate webmail interfaces. The package's presence risks exposure of sensitive credentials and system information. Because the package enables active attacks on third parties and compromises the host, the impact is severe. Removal of the package does not guarantee full remediation due to potential persistence mechanisms.
Mitigation Recommendations
No official patch or fix is available for nolimit-x. Immediate removal of the package from all affected systems is recommended. Due to the high risk of full system compromise, all secrets, credentials, and keys stored on affected machines should be rotated from a separate, trusted environment. Monitor for any signs of persistence or additional malicious software installed alongside nolimit-x. Exercise caution with packages that use heavy obfuscation and conduct thorough audits before installation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-4621
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-cp8c-2xwh-q227"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4f6c3d68715ace431589d8
Added to database: 07/09/2026, 09:39:09 UTC
Last enriched: 07/09/2026, 09:54:02 UTC
Last updated: 07/31/2026, 20:14:03 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.