MalwarePublished 10 Jul 2026

notify-funcs (npm) · Malicious Code

Affects notify-funcsSource GCVE Database

Malicious package : remove notify-funcs and rotate any secrets on hosts that installed it.

Data as of 12 Jul 2026, 09:18 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10155

What to do

Remove notify-funcs from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnotify-funcs	Affected =1.3.5 =1.3.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9b65341bde476af6b80e1fbaa9f9a844b7fdc023ef02f5fabb88514d88012159) The package presents itself as a pino-compatible logging middleware (exports `check` as both default and `pino` named export) but its actual behavior on invocation is to spawn a detached Node child running lib/vcall.js, which fetches JavaScript from an IPFS gateway URL (https://emerald-accurate-urial-9.mypinata.cloud/ipfs/bafkreify2ijjvromekknzxzvqaopft6muwlpl37mvmpdeazwzzkbjzkuxm) and executes the response via `new Function.constructor('require', src)(require)`, granting the remote payload full Node.js capabilities. The detached spawn is designed to survive parent exit. lib/const.js also ships base64-encoded strings (e.g. DEV_API_KEY decoding to https://jsonkeeper.com/b/ZK45J) referencing an anonymous paste-host endpoint consistent with additional staging. The logger-mimicking API surface and pino-shaped exports are a decoy for the remote-execution dropper: any consumer wiring this as Express middleware triggers arbitrary remote code execution on the host.

Impact

Any system that installs and uses notify-funcs versions 1.3.5 or 1.3.6 as middleware is vulnerable to arbitrary remote code execution. The attacker can execute any code with the privileges of the Node.js process, potentially leading to full system compromise, data theft, or further lateral movement. The detached child process mechanism allows the malicious code to persist independently of the parent process, increasing the risk and difficulty of detection and removal.

Defensive guidance

Users should immediately cease using these versions and remove the package from their projects. Avoid installing or running this package from untrusted sources. Monitor for any usage of notify-funcs in your environment and replace it with a trusted alternative. Check vendor advisories or trusted security sources for updates or official fixes.

Summary

The notify-funcs package (versions 1.3.5 and 1.3.6) pretends to be a logging middleware compatible with pino but actually spawns a detached Node.js child process running lib/vcall.js. This child process fetches JavaScript code from a remote IPFS gateway URL and executes it dynamically via Function constructor, granting the remote payload full Node.js capabilities. The detached process is designed to persist beyond the parent process exit. Additional base64-encoded strings in the package reference anonymous paste-host endpoints, indicating further staging infrastructure. The package's API surface is a decoy to facilitate arbitrary remote code execution on any host that uses it as Express middleware.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Jul 2026, 09:58 UTC

Technical details

References

Community reviews