Malicious code in @nzeros/codebreak (npm)
The npm package @nzeros/codebreak version 1.3.0 contains a malicious component. While the package claims to provide a small C minimax solver, its Linux x64 compiled binaries are large Go executables that perform unexpected network and process operations. These binaries run automatically during installation on Linux x64 systems, executing opaque code inconsistent with the package's stated purpose. The exact network destinations or payloads of the embedded Go binary cannot be determined from available data.
AI Analysis
Technical Summary
The @nzeros/codebreak npm package version 1.3.0 declares a small C minimax solver as its source, but the Linux x64 vendor binaries are instead large Go ELF executables (~33MB) linking network, process execution, and cryptographic libraries. These binaries execute automatically during installation via a postinstall script that runs a selftest command. The disparity between the declared C source and the actual large Go binaries, including a Linux ELF present in the darwin-x64 slot, indicates the package was not built from the declared source. The embedded Go binary performs network activity and process execution, representing a fetch-and-execute style embedded payload. The network endpoints or full behavior cannot be discerned from static analysis of strings.
Potential Impact
Installation of version 1.3.0 of @nzeros/codebreak on Linux x64 systems results in automatic execution of a large opaque Go binary with network client, process execution, and cryptographic capabilities. This could lead to unauthorized network communications, execution of arbitrary commands, and potential compromise of the host system. The malicious payload is embedded in the package tarball and runs without user consent during installation.
Mitigation Recommendations
No official patch or remediation guidance is provided. Users should avoid installing version 1.3.0 of @nzeros/codebreak. Audit existing installations for this version and remove the package if found. Consider using trusted package sources and verifying package integrity before installation. Monitor for vendor advisories for any updates or fixes.
Malicious code in @nzeros/codebreak (npm)
Description
The npm package @nzeros/codebreak version 1.3.0 contains a malicious component. While the package claims to provide a small C minimax solver, its Linux x64 compiled binaries are large Go executables that perform unexpected network and process operations. These binaries run automatically during installation on Linux x64 systems, executing opaque code inconsistent with the package's stated purpose. The exact network destinations or payloads of the embedded Go binary cannot be determined from available data.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @nzeros/codebreak npm package version 1.3.0 declares a small C minimax solver as its source, but the Linux x64 vendor binaries are instead large Go ELF executables (~33MB) linking network, process execution, and cryptographic libraries. These binaries execute automatically during installation via a postinstall script that runs a selftest command. The disparity between the declared C source and the actual large Go binaries, including a Linux ELF present in the darwin-x64 slot, indicates the package was not built from the declared source. The embedded Go binary performs network activity and process execution, representing a fetch-and-execute style embedded payload. The network endpoints or full behavior cannot be discerned from static analysis of strings.
Potential Impact
Installation of version 1.3.0 of @nzeros/codebreak on Linux x64 systems results in automatic execution of a large opaque Go binary with network client, process execution, and cryptographic capabilities. This could lead to unauthorized network communications, execution of arbitrary commands, and potential compromise of the host system. The malicious payload is embedded in the package tarball and runs without user consent during installation.
Mitigation Recommendations
No official patch or remediation guidance is provided. Users should avoid installing version 1.3.0 of @nzeros/codebreak. Audit existing installations for this version and remove the package if found. Consider using trusted package sources and verifying package integrity before installation. Monitor for vendor advisories for any updates or fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13736
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a7b6fdabf8831d5393eb21b
Added to database: 08/11/2026, 18:54:18 UTC
Last enriched: 08/11/2026, 18:58:15 UTC
Last updated: 08/11/2026, 18:58:15 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.