MalwarePublished 13 Jul 2026

pure-folder-three (npm) · Malicious Code

Affects pure-folder-threeSource GCVE Database

Malicious package : remove pure-folder-three and rotate any secrets on hosts that installed it.

Data as of 13 Jul 2026, 09:52 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10218

What to do

Remove pure-folder-three from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpure-folder-three	Affected 0.5.0 – 0.7.3 5 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The pure-folder-three npm package versions 0.5.0, 0.6.0, 0.7.0, 0.7.1, and 0.7.3 contain malicious code that executes attacker-controlled shell commands both during installation and when the package is imported. The malicious code fetches a payload from a remote server and executes it, giving the attacker arbitrary command execution on the host. The payload is obfuscated and includes a check to avoid execution on machines with usernames containing 'justin'. This results in a full compromise of any system running or installing the affected package versions.

Impact

Any system that installs or imports the affected pure-folder-three package versions is subject to arbitrary remote code execution by an attacker-controlled server. This leads to full system compromise, including potential theft or destruction of secrets, keys, and other sensitive data. The attacker gains complete control over the compromised host.

Defensive guidance

Users should immediately remove all affected versions of the pure-folder-three package (0.5.0, 0.6.0, 0.7.0, 0.7.1, 0.7.3) from their systems. Because the package grants full control to an external attacker, all secrets and keys stored on the compromised systems should be rotated from a separate, trusted environment. Monitor for any signs of compromise and consider rebuilding affected systems to ensure removal of all malicious artifacts.

Summary

The pure-folder-three npm package in versions 0.5.0 through 0.7.3 includes a postinstall script and import-time code that decode an obfuscated URL and dynamically require the https module. It makes an HTTPS request to a remote server and executes the content of the response header 'm' via child_process.execSync, enabling remote arbitrary command execution. The malicious code is gated by a username check to exclude the author's own machine. Because the malicious code runs both on install and on import, ignoring npm install scripts does not prevent exploitation. This results in a fully compromised system where all stored secrets and keys are at risk.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Jul 2026, 09:52 UTC

Technical details

References

Community reviews