passport811 (npm) · Malicious Code
Affects passport811Source GCVE Database
Malicious package : remove passport811 and rotate any secrets on hosts that installed it.
Data as of 12 Aug 2026, 16:58 UTC
Malicious package
Published to npm · OSV MAL-2026-13832
What to do
Remove passport811 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmpassport811 | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package passport811@1.0.0 contains a malicious HTML file that impersonates a Cloudflare Turnstile challenge. When triggered, it redirects users to a Microsoft typosquatting domain (microsofte.live) via obfuscated JavaScript. The package does not execute code during installation or require calls and serves as a hosted phishing kit distributed through the npm registry. Installation or use of this package may lead to full compromise of the affected system.