MalwarePublished 5 Aug 2026

pfp-forms-sme-registration-ooo (npm) · Malicious Code

Affects pfp-forms-sme-registration-oooSource GCVE Database

Malicious package : remove pfp-forms-sme-registration-ooo and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:27 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12187

What to do

Remove pfp-forms-sme-registration-ooo from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpfp-forms-sme-registration-ooo	Affected =20.2.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package pfp-forms-sme-registration-ooo version 20.2.1 contains malicious code that downloads and executes an attacker-controlled native binary on the host system during installation or import. This binary is fetched from obfuscated Cloudflare Workers and other domains, saved to disguised paths, made executable, and launched without verification. The package's stated functionality does not require such native code, indicating malicious intent. Systems with this package installed should be considered fully compromised, and secrets should be rotated from a clean environment.

Impact

Any system that installs or runs this package is at risk of full compromise due to arbitrary code execution from an unverified native binary. Attackers gain persistent, stealthy access and control over the host, potentially leading to theft of secrets, credentials, and further system compromise. Removal of the package alone does not guarantee eradication of the malicious payload or backdoors. Immediate secret and key rotation from a separate, uncompromised system is necessary.

Defensive guidance

Remove the pfp-forms-sme-registration-ooo package version 20.2.1 immediately. Consider the host fully compromised and perform a thorough incident response, including rotating all secrets and keys from a clean environment. There is no known patch or official fix available. Avoid installing or importing this package. Monitor for any suspicious activity related to this package's domains or execution patterns.

Summary

The pfp-forms-sme-registration-ooo npm package (version 20.2.1) includes malicious functionality in its index.js, which loads a polyfill script that dynamically reconstructs URLs to fetch a native binary from Cloudflare Workers and other suspicious domains. The binary is saved to hidden paths on POSIX and Windows systems, permissions are set to executable, and it is launched detached from the main process. No integrity checks (hash or signature) are performed on the downloaded binary. The package's advertised purpose does not require this native helper, and opt-out mechanisms rely on generic environment variables, making it ineffective. Installing or importing this package results in arbitrary code execution controlled by an attacker, effectively compromising the host.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:27 UTC

Technical details

References

Community reviews