Malicious code in prezdentkxheiw (npm)
The npm package 'prezdentkxheiw' versions 1.0.0 and 1.0.1 contains a malicious HTML file that impersonates a Cloudflare challenge page and redirects browser visitors to a target URL using obfuscated JavaScript. This package does not execute code on installation or require, and thus does not represent a supply-chain attack against installers. Instead, it abuses the npm registry as static hosting for phishing or redirect landing pages when accessed via browser-based CDN services. Although no direct code execution occurs on the installer's machine, any system running this package should be considered compromised according to one source, recommending immediate secret rotation and package removal. No official patch or fix is documented. No known exploits in the wild have been reported.
AI Analysis
Technical Summary
The 'prezdentkxheiw' npm package (versions 1.0.0 and 1.0.1) contains only an index.html file declared as the main entry point, which impersonates a Cloudflare 'Just a moment...' challenge page. It includes obfuscated JavaScript that reconstructs a URL and redirects browser visitors. There are no lifecycle scripts or JavaScript entry points that execute on installation or require, so installing or requiring the package does not run code on the installer's machine. This package abuses the npm registry as static hosting for phishing or redirect landing pages, targeting browser visitors accessing the package via CDN services like unpkg. One source states that any computer with this package installed or running should be considered fully compromised, recommending immediate secret rotation and removal of the package, although this claim conflicts with the lack of install-time code execution.
Potential Impact
The package does not execute code on installation or require, so it does not compromise the installer's machine through typical supply-chain attack vectors. However, it serves as a phishing or redirect landing page when accessed by browsers, potentially leading users to malicious sites. One source claims that any system with the package installed or running should be considered fully compromised, implying possible post-installation compromise vectors not detailed in the description. There are no known exploits in the wild reported. The primary impact is abuse of the npm registry for phishing and redirect purposes, which could lead to user deception and potential downstream compromise if users follow malicious redirects.
Mitigation Recommendations
No official patch or fix is documented for this package. Since the package does not execute code on installation or require, removing the package from any systems where it is installed is recommended to prevent further abuse. Additionally, if the package has been run or used in any capacity, it is advised to rotate all secrets and keys stored on the affected computer from a different, trusted machine as a precautionary measure. Monitor for any suspicious activity related to phishing or redirects originating from this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.
Malicious code in prezdentkxheiw (npm)
Description
The npm package 'prezdentkxheiw' versions 1.0.0 and 1.0.1 contains a malicious HTML file that impersonates a Cloudflare challenge page and redirects browser visitors to a target URL using obfuscated JavaScript. This package does not execute code on installation or require, and thus does not represent a supply-chain attack against installers. Instead, it abuses the npm registry as static hosting for phishing or redirect landing pages when accessed via browser-based CDN services. Although no direct code execution occurs on the installer's machine, any system running this package should be considered compromised according to one source, recommending immediate secret rotation and package removal. No official patch or fix is documented. No known exploits in the wild have been reported.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'prezdentkxheiw' npm package (versions 1.0.0 and 1.0.1) contains only an index.html file declared as the main entry point, which impersonates a Cloudflare 'Just a moment...' challenge page. It includes obfuscated JavaScript that reconstructs a URL and redirects browser visitors. There are no lifecycle scripts or JavaScript entry points that execute on installation or require, so installing or requiring the package does not run code on the installer's machine. This package abuses the npm registry as static hosting for phishing or redirect landing pages, targeting browser visitors accessing the package via CDN services like unpkg. One source states that any computer with this package installed or running should be considered fully compromised, recommending immediate secret rotation and removal of the package, although this claim conflicts with the lack of install-time code execution.
Potential Impact
The package does not execute code on installation or require, so it does not compromise the installer's machine through typical supply-chain attack vectors. However, it serves as a phishing or redirect landing page when accessed by browsers, potentially leading users to malicious sites. One source claims that any system with the package installed or running should be considered fully compromised, implying possible post-installation compromise vectors not detailed in the description. There are no known exploits in the wild reported. The primary impact is abuse of the npm registry for phishing and redirect purposes, which could lead to user deception and potential downstream compromise if users follow malicious redirects.
Mitigation Recommendations
No official patch or fix is documented for this package. Since the package does not execute code on installation or require, removing the package from any systems where it is installed is recommended to prevent further abuse. Additionally, if the package has been run or used in any capacity, it is advised to rotate all secrets and keys stored on the affected computer from a different, trusted machine as a precautionary measure. Monitor for any suspicious activity related to phishing or redirects originating from this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13833
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-943h-xm4q-hpg6"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a7c9b44bf8831d539cdcfbd
Added to database: 08/12/2026, 16:11:48 UTC
Last enriched: 08/12/2026, 16:41:15 UTC
Last updated: 08/12/2026, 16:41:15 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.