MalwarePublished 14 Aug 2026

notafollower1 (npm) · Malicious Code

Affects notafollower1Source GCVE Database

Malicious package : remove notafollower1 and rotate any secrets on hosts that installed it.

Data as of 16 Aug 2026, 09:02 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-14034

What to do

Remove notafollower1 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnotafollower1	Affected 1.0.0 – 1.0.13 14 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'notafollower1' contains malicious code in multiple versions that executes a postinstall script during installation. This script collects AWS ECS container task metadata and environment details, then sends this information to an unauthorized external ngrok tunnel. It also attempts to identify security researchers by inspecting container image names, indicating targeted sandbox and analyst fingerprinting.

Impact

The malicious postinstall script leaks sensitive AWS ECS container metadata and environment details to an unauthorized external endpoint. This exposure can compromise the confidentiality of the deployment environment and potentially aid attackers in further targeting or evading detection. The fingerprinting of security researchers and sandbox environments suggests deliberate attempts to evade analysis and detection.

Defensive guidance

Users should avoid installing or using the affected versions of the 'notafollower1' package. Review and audit dependencies for malicious postinstall scripts. Consider using package integrity verification tools and restrict network egress from build and deployment environments to prevent unauthorized data exfiltration. Monitor vendor advisories for updates or official fixes.

Summary

The 'notafollower1' npm package versions 1.0.0 through 1.0.13 include a postinstall script that automatically runs on npm install. This script fetches AWS ECS container task metadata from the ECS_CONTAINER_METADATA_URI_V4 endpoint, including task ARNs, container names, and image names. It then exfiltrates this data via a POST request to a hardcoded ngrok URL unrelated to any legitimate publisher infrastructure. Additionally, the script inspects container image names for substrings associated with known security research operators, enabling targeted fingerprinting of sandbox or analyst environments. This behavior reveals sensitive CI/build/container environment details to a third party without user consent.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 16 Aug 2026, 09:02 UTC

Technical details

References

Community reviews