MalwarePublished 25 May 2026Updated 12 Nov 2026

npm-builderio-qwik-poc (npm) · Malicious Code

Affects npm-builderio-qwik-pocSource GCVE Database

Malicious package : remove npm-builderio-qwik-poc and rotate any secrets on hosts that installed it.

Data as of 12 Nov 2026, 21:07 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-4623

What to do

Remove npm-builderio-qwik-poc from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnpm-builderio-qwik-poc	Affected 1.0.1 – 1.0.5 5 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'npm-builderio-qwik-poc' contains malicious code that acts as a browser exploit. When loaded in a DOM context, it creates a hidden iframe targeting pendo.io and injects JavaScript that executes in the pendo.io origin. This script fetches authenticated session data from pendo.io, encodes it, and exfiltrates it to an attacker-controlled webhook URL. The malicious behavior triggers on every load without user consent or configuration. The package does not have Node.js side effects but weaponizes any web application that bundles it against pendo.io users.

Impact

Visitors to web applications bundling this malicious package will have their authenticated pendo.io session data silently stolen and sent to an attacker-controlled server. This compromises user privacy and security by exposing sensitive session information. The attacker gains unauthorized access to pendo.io session data without user consent. The package effectively weaponizes the hosting web application against pendo.io users, potentially leading to account compromise or further attacks leveraging stolen session credentials.

Defensive guidance

Remove the 'npm-builderio-qwik-poc' package immediately from all projects and environments. Rotate all secrets and keys stored on any computer where this package was installed or executed, using a secure, uncompromised system. Since the package grants the attacker potential full control over the affected system, assume full compromise and conduct a thorough security review.

Summary

The 'npm-builderio-qwik-poc' package's main entry point is a browser exploit rather than a legitimate library. It creates a hidden iframe pointing to 'www.pendo.io?builder.frameEditing=true' and sends postMessages that cause the Builder.io SDK to execute attacker-controlled JavaScript in the pendo.io origin. This injected script performs a credentialed fetch to 'https://novus-api.pendo.io/pendo/app', base64-encodes the response, splits it into chunks, and exfiltrates each chunk via image requests to a hardcoded attacker webhook URL. This results in silent leakage of authenticated pendo.io session data from site visitors. The exfiltration is unconditional and requires no user interaction. The package's malicious effect only manifests in browser DOM contexts and does not affect Node.js runtime directly. Any developer including this package in their web app inadvertently enables this data theft against pendo.io users.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Nov 2026, 21:07 UTC

Technical details

References

Community reviews