MalwarePublished 13 Aug 2026

path-match-js (npm) · Malicious Code

Affects path-match-jsSource GCVE Database

Malicious package : remove path-match-js and rotate any secrets on hosts that installed it.

Data as of 14 Aug 2026, 16:46 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-14005

What to do

Remove path-match-js from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpath-match-js	Affected =1.0.7 =1.0.8	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package path-match-js versions 1.0.7 and 1.0.8 were found to contain malicious code or depend on a malicious package. Any system with these versions installed should be considered fully compromised, requiring immediate secret and key rotation from a separate device. Removing the package alone may not fully eliminate the threat due to potential persistent malicious control.

Impact

Systems with path-match-js versions 1.0.7 or 1.0.8 installed are considered fully compromised. Attackers may have gained full control, risking exposure and theft of secrets, keys, and sensitive data. The compromise may persist beyond removal of the package, indicating potential for ongoing unauthorized access or malicious activity.

Defensive guidance

Remove the affected versions (1.0.7 and 1.0.8) of path-match-js immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure machine. Due to the likelihood of persistent compromise, consider rebuilding or thoroughly cleaning affected systems to ensure removal of all malicious components.

Summary

The path-match-js package versions 1.0.7 and 1.0.8 include malicious code or consume dependencies with malicious code, leading to full compromise of affected systems. The advisory states that any computer running these versions is at risk of complete takeover by an external entity. Consequently, all secrets and keys stored on the compromised machine must be rotated immediately from a different, secure computer. The package removal is recommended but may not suffice to remove all malicious artifacts or backdoors introduced by the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 16:46 UTC

Technical details

References

Community reviews