MalwarePublished 16 Jun 2026Updated 13 Jul 2026

nottuff15 (npm) · Malicious Code

Affects nottuff15Source GCVE Database

Malicious package : remove nottuff15 and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5914

What to do

Remove nottuff15 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnottuff15	Affected =1.7.7 =2.0.0 =1.1.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'nottuff15' version 1.7.7 is part of a coordinated namespace-spam campaign distributing malicious code. It contains a bundled single-page application and a ServiceWorker web-proxy with a large WASM-curl bundle, intended to be hosted as a static site but abused via npm as a static-asset CDN. The package's main script triggers browser redirects to an affiliate site and loads heavily obfuscated JavaScript. It does not execute code during installation but running or installing it can lead to full system compromise. Immediate removal and secret/key rotation are advised.

Impact

Installation or execution of this package can lead to full system compromise. The package enables browser-based redirects to potentially malicious affiliate sites and loads obfuscated scripts, which may facilitate further malicious activity. Because the package is part of a broader namespace-spam campaign, it abuses npm as a CDN for hosting malicious static assets. Secrets and keys stored on compromised systems should be considered exposed and rotated immediately.

Defensive guidance

The package should be removed immediately from any affected system. All secrets and keys stored on compromised systems must be rotated from a separate, trusted environment. Since full system compromise is possible, further forensic investigation and remediation may be necessary. Monitor for and block access to the known malicious domains (e.g., abdct.com, cdn.21baseballacademy.com).

Summary

The 'nottuff15' npm package (version 1.7.7) is malicious software distributed as part of a namespace-spam campaign involving nearly 95 similarly named packages. The package includes a bundled SPA and ServiceWorker that acts as a web proxy, along with a 5.4MB WASM-curl bundle. Its main entry point (sw.js) uses browser ServiceWorker APIs not available in Node.js, causing errors if required as a library. The package redirects user interactions to an affiliate site and loads obfuscated remote scripts. There are no install-time scripts, so no automatic execution occurs during installation. However, any system with this package installed or running should be considered fully compromised, requiring secret and key rotation from a clean environment.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Jul 2026, 09:24 UTC

Technical details

References

Community reviews