MalwarePublished 22 Oct 2026Updated 29 Oct 2026

@pkgship/frpc-linux-amd64 (npm) · Malicious Code

Affects @pkgship/frpc-linux-amd64Source GCVE Database

Malicious package : remove @pkgship/frpc-linux-amd64 and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:25 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18198

What to do

Remove @pkgship/frpc-linux-amd64 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@pkgship/frpc-linux-amd64	Affected =0.71.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @pkgship/frpc-linux-amd64 version 0.71.1 contains malicious code. Although it ships a prebuilt binary without suspicious lifecycle scripts or network activity during installation, the package is identified as malware. Any system with this package installed or running should be considered fully compromised, requiring immediate secret and key rotation and package removal. However, removal may not guarantee complete eradication of malicious software.

Impact

Any computer with this package installed or running is considered fully compromised. All stored secrets and keys on the affected system should be rotated immediately from a separate, trusted machine. Removing the package is recommended but may not fully remove all malicious components introduced by the package, indicating a high risk of persistent compromise.

Defensive guidance

Remove the @pkgship/frpc-linux-amd64 package version 0.71.1 immediately. Rotate all secrets and keys stored on the affected system from a different, secure computer. Due to the potential for persistent compromise, conduct a thorough system investigation and remediation beyond package removal.

Summary

The package @pkgship/frpc-linux-amd64@0.71.1 is a platform-specific npm distribution containing a prebuilt frpc binary for linux-amd64. No install-time malicious behaviors such as secret exfiltration or persistence mechanisms were observed. Despite this, the package is classified as malware by a trusted source, indicating that installation or execution of the package compromises the host system. The frpc binary is a reverse-proxy/tunneling tool, which operates only when explicitly invoked by the user. The malware classification implies that the package may enable full system compromise once run, necessitating urgent remediation.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:25 UTC

Technical details

References

Community reviews