MalwarePublished 5 Aug 2026Updated 21 Aug 2026

pvm-autodoc (npm) · Malicious Code

Affects pvm-autodocSource GCVE Database

Malicious package : remove pvm-autodoc and rotate any secrets on hosts that installed it.

Data as of 21 Aug 2026, 16:59 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12421

What to do

Remove pvm-autodoc from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpvm-autodoc	Affected =20.4.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'pvm-autodoc' version 20.4.6 contains malicious code that downloads and executes an unverified native binary from hardcoded Cloudflare Workers subdomains or a DNS TXT fallback. This binary is saved to temporary directories with names mimicking legitimate diagnostic tools and executed without user consent. The package also includes a companion payload performing similar fetch-and-execute actions. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems must be rotated immediately. Removal of the package alone does not guarantee elimination of all malicious components.

Impact

Any system with 'pvm-autodoc' version 20.4.6 installed or running is considered fully compromised. The malicious code grants full control to an external entity by executing unverified native binaries, potentially allowing attackers to access all stored secrets and keys. Immediate rotation of all credentials from a separate, uncompromised system is necessary. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the payload.

Defensive guidance

Users should immediately remove the 'pvm-autodoc' package version 20.4.6 from all systems. All secrets, keys, and credentials stored on affected systems must be rotated from a secure, uncompromised environment. Due to the high likelihood of full system compromise, consider rebuilding affected systems from known good backups or reinstalling the operating system to ensure complete remediation.

Summary

The 'pvm-autodoc' npm package (version 20.4.6) contains embedded malicious code that dynamically constructs hostnames to download a platform-specific native binary from multiple hardcoded Cloudflare Workers subdomains or a DNS TXT base64 chunked fallback domain. The downloaded binary is saved to temporary file locations on POSIX or Windows systems, given executable permissions, and executed detached from the parent process. The package disguises this behavior under the guise of 'analytics' or 'telemetry' but actually performs fetch-and-execute of an opaque, unpinned native binary. Additionally, a companion JavaScript payload in the package uses similar obfuscated methods to fetch, decode, and spawn processes. This behavior results in full system compromise upon installation or execution of the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 21 Aug 2026, 16:59 UTC

Technical details

References

Community reviews