path-internal (npm) · Malicious Code
Affects path-internalSource GCVE Database
Rated by Threat Radar
Data as of 8 Sep 2026, 12:54 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmpath-internal | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should immediately remove and avoid installing the 'path-internal' package. Replace it with the official Node.js 'path' module or a trusted alternative. Monitor dependency trees for this package and block it in supply chain processes. Since the package fetches code from an external mutable source, network controls to block access to jsonkeeper.com may reduce risk. Check vendor advisories or npm security advisories for updates.
Description
The npm package 'path-internal' impersonates the Node.js core 'path' module but contains malicious code. It fetches and executes arbitrary code from an external URL via eval(), enabling remote code execution. The package uses obfuscation and typosquatting to disguise its malicious intent. Multiple versions of the package are affected.