VulnerabilityPublished 14 Apr 2026Updated 1 Sep 2026

path-extend (npm) · Malicious Code

Affects path-extendSource GCVE Database

Severity

High

Rated by Threat Radar

Data as of 25 Oct 2026, 04:27 UTC

What to do

Affected software

Product	Affected	Fixed in
npmpath-extend	Affected =1.0.6 =1.0.11 =1.0.10 =1.0.12 =1.0.13 =1.0.0 =1.0.1 =1.0.2 =1.0.3 =1.0.4 =1.0.5 =1.0.7 =1.0.8 =1.0.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Remove the 'path-extend' package immediately from all systems. Rotate all secrets and keys stored on affected machines from a separate, trusted environment. Because the attacker may have established persistent control, consider full system audits and potential reimaging.

Description

The npm package 'path-extend' is a malicious typosquatting package that mimics Node.js's built-in 'path' module. It injects code that fetches attacker-controlled JavaScript from an anonymous JSON paste service and executes it via eval(), allowing dynamic remote code execution. Installing or requiring this package results in running arbitrary code controlled by the attacker, potentially compromising the entire system and exposing all stored secrets and keys.

Impact

Any system that installs or requires the 'path-extend' package is fully compromised, as attacker-controlled code executes within the Node.js process. This can lead to complete system takeover, exposure of secrets and keys, and persistent malicious presence. Removal of the package does not guarantee eradication of all malicious artifacts or backdoors introduced by the attacker.

Summary

The 'path-extend' npm package (versions 1.0.0 through 1.0.13) is a malicious typosquatting package targeting the Node.js 'path' module. Its path.js file is a near-verbatim copy of Node core's path.js but includes an injected Immediately Invoked Function Expression (IIFE) that fetches base64-encoded JavaScript payloads from jsonkeeper.com, an anonymous and mutable JSON paste host. These payloads are then executed via eval(), enabling the attacker to run arbitrary code in the Node process at any time by modifying the remote JSON content. The package uses obfuscated variable names and base64 encoding to evade detection. The package.json metadata is suspicious, with an empty author field and a generic description. This behavior effectively grants full control of the affected computer to the attacker.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 25 Oct 2026, 04:27 UTC

Technical details

References

Community reviews