MalwarePublished 22 Oct 2026Updated 29 Oct 2026

@pkgship/frps-linux-amd64 (npm) · Malicious Code

Affects @pkgship/frps-linux-amd64Source GCVE Database

Malicious package : remove @pkgship/frps-linux-amd64 and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:25 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18199

What to do

Remove @pkgship/frps-linux-amd64 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@pkgship/frps-linux-amd64	Affected =0.71.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @pkgship/frps-linux-amd64 version 0.71.1 is identified as malicious. It distributes a platform-specific binary for Linux AMD64 that is consistent with the frp reverse-proxy server, but the package is considered malware. Although no install-time execution or network behavior was observed in the initial inspection, the package is flagged as fully compromising any system where it is installed or running. Immediate secret and key rotation is recommended, and removal of the package is advised, but full remediation may require additional measures due to potential persistent compromise.

Impact

Systems with the @pkgship/frps-linux-amd64 package version 0.71.1 installed or running should be considered fully compromised. All secrets and keys stored on such systems are at risk and must be rotated immediately from a different, trusted system. Removal of the package alone may not fully eliminate the malicious presence, indicating potential persistence or additional malware components beyond the package itself.

Defensive guidance

Remove the @pkgship/frps-linux-amd64 package version 0.71.1 immediately from affected systems. Rotate all secrets and keys stored on compromised systems using a separate, trusted environment. Due to the high likelihood of full system compromise, conduct a thorough investigation and remediation beyond just package removal to ensure complete eradication of malicious components.

Summary

The npm package @pkgship/frps-linux-amd64 version 0.71.1 distributes a Linux AMD64 binary resembling the frp reverse-proxy server. Initial analysis found no install-time execution, network activity, or credential access patterns, and no lifecycle scripts or hardcoded exfiltration endpoints. However, a secondary source strongly indicates that any system with this package installed or running is fully compromised, recommending immediate secret rotation and package removal. The binary itself was not independently inspected in this record, but the package is classified as malware with a high risk of system compromise.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:25 UTC

Technical details

References

Community reviews