MalwarePublished 8 Jul 2026Updated 15 Jul 2026

none123s (npm) · Malicious Code

Affects none123sSource GCVE Database

Malicious package : remove none123s and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:36 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-7024

What to do

Remove none123s from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnone123s	Affected 0.1.0 – 1.1.7 17 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c28e7ef260830adb9561488c487960b12e00bd6939daf8ed8e3a239ec9530699) package.json declares a `prepare` lifecycle script (`node index.js || true`) that auto-executes on `npm install`. index.js reads canonical installer-secret paths — ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.aws/credentials, ~/.config/gcloud/application_default_credentials.json, ~/.npmrc, ~/.pypirc, ~/.docker/config.json, ~/.gitconfig, and.env files walking up parent directories — plus a curated set of cloud/CI environment variables, and POSTs the contents to a hardcoded attacker-controlled ngrok tunnel at https://crabbing-thong-overhung.ngrok-free.dev/exfil. A separate `sendInitialPing` beacon posts host identifiers (hostname, platform, user, homedir, cwd, node version, npm lifecycle env, git user.email) to the same host at /ping to identify the victim. The `|| true` suffix silences errors so the install appears successful. This is a direct credential-theft supply-chain attack against any developer or CI system that installs the package. ## Source: ghsa-malware (87b3283e298b85e9f69225b2364436289724e45eab50b2e8903a07b26cefbf51) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (48e2daf1cc54ff9575c264652d0dc5f8dfbc9a0f0dbf009dca193726dcfbea5a) The OpenSSF Package Analysis project identified 'none123s' @ 0.1.2 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

Impact

Systems that install any affected version of the 'none123s' package are at high risk of credential theft, including SSH keys, cloud service credentials, and other sensitive configuration files. The attacker gains access to these secrets remotely, potentially leading to unauthorized access to cloud resources, code repositories, and other critical infrastructure. The presence of this package indicates a full compromise of the host environment. Removal of the package alone does not guarantee eradication of the attacker presence.

Defensive guidance

Immediate removal of the 'none123s' package from all systems is required. All credentials and secrets potentially exposed by the package must be rotated immediately using a trusted, uncompromised machine. Systems suspected of infection should be treated as fully compromised and undergo thorough investigation and remediation. Avoid installing packages from untrusted sources and verify package integrity before installation.

Summary

The 'none123s' npm package versions including 0.1.0 through 1.1.7 (specific versions enumerated) contain a 'prepare' lifecycle script that runs on 'npm install'. This script reads private keys and credential files such as SSH keys, AWS credentials, Google Cloud credentials, npm and Docker configs, and environment variables. It sends this sensitive information to a hardcoded attacker-controlled ngrok domain. Additionally, it sends host metadata to the same domain to identify infected systems. The script suppresses errors to avoid detection. This is a supply-chain attack targeting developers and CI systems that install the package, resulting in credential theft and potential full system compromise.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 09:43 UTC

Technical details

References

Community reviews