VulnerabilityPublished 09/08/2026

Malicious code in open-item-validator (npm)

Affects open-item-validatorSource GCVE Database

Severity

Critical

Rated by Threat Radar

Data as of 09/09/2026, 13:54:23 UTC

What to do

Affected software

Product	Affected	Fixed in
npmopen-item-validator	Affected =1.0.3 =1.0.5 =1.0.2 =1.0.0 =1.0.4 =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Users should immediately stop using the open-item-validator package versions 1.0.0 through 1.0.5. Remove the package from all environments and replace it with a trusted alternative. Monitor for any processes spawned by this package and investigate any suspicious activity.

Description

The open-item-validator npm package versions 1.0.0 through 1.0.5 contain malicious code that, upon require(), spawns a detached background Node.js process. This process repeatedly fetches JavaScript code over unencrypted HTTP from a dynamic DNS endpoint controlled by an attacker and executes it, allowing arbitrary code execution on the host. The fetch endpoint does not match the publisher's declared homepage, and the package's signature verification does not prevent the attacker from controlling the executed code.

Impact

An attacker controlling the remote HTTP endpoint can execute arbitrary Node.js code on any system that loads the affected open-item-validator package. This code runs in a detached background process that survives the parent process, enabling persistent malicious activity. The impact includes full compromise of the host environment where the package is installed, potentially leading to data theft, system manipulation, or further malware deployment.

References

Community reviews

Loading reviews…