MalwarePublished 13 Jun 2026Updated 15 Jul 2026

patientdocuments (npm) · Malicious Code

Affects patientdocumentsSource GCVE Database

Malicious package : remove patientdocuments and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:53 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5752

What to do

Remove patientdocuments from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpatientdocuments	Affected =75.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The patientdocuments npm package version 75.0.0 contains malicious code that executes a preinstall script during npm install. This script sends the installer's OS username, current working directory, and hostname to an attacker-controlled endpoint over unencrypted HTTP. The package does not provide any legitimate functionality and is designed solely for reconnaissance and identity exfiltration. The package sets unsafe-perm, allowing the script to run with elevated privileges, increasing the risk of system compromise. Removal of the package does not guarantee full remediation as the system may already be fully compromised.

Impact

The malicious package leaks sensitive system information including the OS username, current working directory, and hostname to an attacker-controlled server. Because unsafe-perm is enabled, the malicious script can execute with root privileges in privileged install contexts, potentially allowing full system compromise. The presence of this package indicates a high likelihood that the system is compromised, and all secrets and keys stored on the system should be considered exposed and rotated immediately. Removing the package alone may not fully remediate the compromise.

Defensive guidance

The recommended mitigation is to immediately remove the patientdocuments package version 75.0.0 from all affected systems. Treat any system with this package installed as fully compromised. Rotate all secrets, keys, and credentials from a separate, trusted system. Conduct a thorough security assessment to identify and remediate any additional malicious artifacts or persistence mechanisms that may have been installed. Monitor for any suspicious activity related to this package or its indicators.

Summary

The patientdocuments npm package version 75.0.0 includes a preinstall lifecycle script that runs a wget command to send sensitive environment information (username, working directory, hostname) to a malicious Cloudflare Workers endpoint over plain HTTP. This script also appears in the test and preupdate lifecycle scripts. The package contains no legitimate library code and is a dependency-confusion style malicious package designed for reconnaissance and identity exfiltration. The unsafe-perm flag is set, which can cause the script to execute with root privileges in privileged install contexts. According to the GHSA advisory, any system with this package installed should be considered fully compromised, requiring immediate secret and key rotation and removal of the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 12:53 UTC

Technical details

References

Community reviews