MalwarePublished 9 Jul 2026Updated 10 Jul 2026

nonenull1 (npm) · Malicious Code

Affects nonenull1Source GCVE Database

Malicious package : remove nonenull1 and rotate any secrets on hosts that installed it.

Data as of 12 Jul 2026, 09:18 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10090

What to do

Remove nonenull1 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnonenull1	Affected 1.0.0 – 1.6.0 9 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (162cd9e0496d35e0500fe084f6011a3e6893182b0fa209502c5d6017ab1138ac) The package declares `gypfile: true` with no native C/C++ sources, and its binding.gyp abuses GYP command-expansion syntax in the `sources` list — `<!(node index.js...)` with `type: none` — so that npm's automatic `node-gyp rebuild` step runs `node index.js` during install-time configure. index.js then collects installer identifiers via `os.hostname()`, `os.userInfo().username`, and the CI environment variables `GITHUB_REPOSITORY` and `RUNNER_ENVIRONMENT`, and POSTs a JSON body to a hardcoded ngrok tunnel at `crabbing-thong-overhung.ngrok-free.dev` (`https://crabbing-thong-overhung.ngrok-free.dev/?gyp_rce=1`). It also drops `GYP_STEALTH_PWNED.txt` into `GITHUB_WORKSPACE` (or cwd) whose content self-identifies as `Stealth RCE via binding.gyp!`. There are no shipped native sources for the GYP config to build; the binding.gyp exists solely to trigger the embedded JS at install. The absence of any explicit `install`/`postinstall` script masks the lifecycle execution — the trigger is `binding.gyp` presence, which npm resolves via `node-gyp rebuild`. This is a fully automatic install-time RCE and CI-reconnaissance beacon, with the ngrok destination indicating an author-controlled receiver. ## Source: ossf-package-analysis (5f02ee2873da4d092fe8c8cc7418db3d2c661a64e5015eb0505fe26e5979da80) The OpenSSF Package Analysis project identified 'nonenull1' @ 1.5.2 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Impact

This package enables automatic remote code execution during installation without explicit install scripts, allowing attackers to execute arbitrary code on the victim's system. It also collects and exfiltrates environment and installer information to an attacker-controlled server, potentially compromising sensitive CI environment data. This can lead to unauthorized access, data leakage, and further compromise of the development or deployment environment.

Defensive guidance

Users should avoid installing or using the 'nonenull1' package in any of the affected versions. Review dependency trees for this package and remove or replace it. Monitor for any unexpected files such as 'GYP_STEALTH_PWNED.txt' in build or workspace directories as an indicator of compromise.

Summary

The 'nonenull1' npm package (versions 1.0.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.2, 1.5.4, 1.5.5, 1.6.0) is malicious. It declares 'gypfile: true' with no native sources and uses binding.gyp to trigger 'node index.js' during npm's 'node-gyp rebuild' install step. The index.js script collects system and CI environment data and exfiltrates it via HTTP POST to a hardcoded ngrok domain controlled by the attacker. It also drops a file named 'GYP_STEALTH_PWNED.txt' to mark the compromise. This technique bypasses explicit lifecycle scripts, enabling stealthy automatic install-time remote code execution and data exfiltration.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 09:39 UTC

Technical details

References

Community reviews