MalwarePublished 10 Oct 2026Updated 29 Oct 2026

passwordcracker (npm) · Malicious Code

Affects passwordcrackerSource GCVE Database

Malicious package : remove passwordcracker and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 14:07 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17864

What to do

Remove passwordcracker from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpasswordcracker	Affected =1.1.1 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'passwordcracker' is a malicious package masquerading as a dependency-free Discord MFA library. It pulls and executes code from an attacker-controlled GitHub repository and, on Windows systems, downloads and runs a hidden script that persists through multiple startup mechanisms and checks for updates regularly. It also contains offensive functionality targeting Discord API endpoints with operator-supplied credentials and disables TLS verification for Discord domains. The package was published by the npm account 'kingsize' with identical malicious code in versions 1.0.0 and 1.1.1.

Impact

The package enables remote code execution by fetching and running attacker-controlled code during installation and runtime. On Windows, it installs a persistent backdoor that downloads and executes scripts from a malicious URL, evades detection by hiding files and processes, and maintains persistence through multiple startup mechanisms. The package also facilitates offensive operations against Discord accounts using supplied credentials, potentially compromising user accounts and data. This behavior poses a significant risk of system compromise, data theft, and unauthorized access to Discord services.

Defensive guidance

Users should immediately uninstall the 'passwordcracker' package versions 1.0.0 and 1.1.1 and remove any associated files and persistence mechanisms on affected Windows systems. Avoid installing npm packages from untrusted sources, especially those that fetch code from unverified external repositories. Monitor for suspicious activity related to Discord accounts and consider resetting credentials if the package was used.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 14:07 UTC

Technical details

References

Community reviews