MalwarePublished 10 Jul 2025Updated 29 Oct 2025

preview-server-auth (npm) · Malicious Code

Affects preview-server-authSource GCVE Database

Malicious package : remove preview-server-auth and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 22:53 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-5820

What to do

Remove preview-server-auth from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpreview-server-auth	Affected >=1.1.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'preview-server-auth' version 1.1.4 and later communicates with a domain linked to malicious activity. Installation or execution of this package results in a fully compromised system, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all credentials from a separate, uncompromised system is strongly advised.

Impact

Systems with 'preview-server-auth' package version 1.1.4 or later installed or running are considered fully compromised. Attackers may have gained full control over the affected computer, leading to potential theft or misuse of all stored secrets and keys. This represents a severe security breach with high risk to confidentiality and system integrity.

Defensive guidance

Remove the 'preview-server-auth' package immediately from all affected systems. Rotate all secrets and keys stored on the compromised systems from a different, secure computer. Due to the likelihood of full system compromise, further forensic analysis and remediation may be necessary to ensure all malicious components are eradicated.

Summary

The 'preview-server-auth' npm package (versions >=1.1.4) has been identified as malicious due to its communication with a domain associated with malicious activity. According to the source, any system with this package installed or running should be considered fully compromised, as it may grant external actors full control. The package's presence risks exposure of all secrets and keys stored on the affected system. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.

References

github.com/advisories/GHSA-vjgr-r64h-xffx (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 22:53 UTC

Technical details

References

Community reviews