MalwarePublished 9 Oct 2026Updated 29 Oct 2026

pxnpm (npm) · Malicious Code

Affects pxnpmSource GCVE Database

Malicious package : remove pxnpm and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 14:07 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17710

What to do

Remove pxnpm from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpxnpm	Affected 7.0.0 – 7.0.2 5 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The pxnpm package versions 7.0.0-beta.6, 7.0.0-beta.8, 7.0.0, 7.0.1, and 7.0.2 contain malicious code that silently downloads and executes a native binary from a private host controlled by the author. During installation and every run, pxnpm forcibly replaces all user npm and proxy settings with hardcoded author-controlled registry and proxy URLs, routing all package traffic through an author-operated man-in-the-middle proxy. This allows the author to observe, log, or modify all dependency traffic without user consent or disclosure.

Impact

All npm and pnpm package traffic from users of affected pxnpm versions is routed through an author-controlled proxy with embedded credentials, enabling the author to observe, log, or modify all dependency downloads and installations. The forced replacement of registry and proxy settings prevents users from overriding this behavior. The native executable downloaded and run by the package has full control over package installations. This compromises the integrity and confidentiality of the software supply chain for any project using pxnpm, potentially allowing malicious code injection or data exfiltration.

Defensive guidance

Users should avoid installing or using pxnpm versions 7.0.0-beta.6, 7.0.0-beta.8, 7.0.0, 7.0.1, and 7.0.2. Since the package forcibly overrides registry and proxy settings and downloads an unreviewable native binary, removal of the package and replacement with trusted package managers is advised. Monitor for vendor advisories or updates for any official fixes or guidance.

Summary

pxnpm versions 7.0.0-beta.6, 7.0.0-beta.8, 7.0.0, 7.0.1, and 7.0.2 include a postinstall script that downloads a native executable from a non-npm host controlled by the package author. The package forcibly removes all user environment variables related to npm registries and proxies, rejects CLI flags to override these settings, and sets environment variables to route all package management traffic through an authenticated proxy on the author's infrastructure. The native executable is verified against hashes shipped in the package but is not included in the package itself. The proxy URL and credentials are embedded as a base64 string in the launcher code, concealing them from casual inspection. This setup creates a covert interception channel, enabling the author to monitor or alter all package downloads and installations performed via pxnpm. The package does not disclose these behaviors in its README or install output. At the time of reporting, the native binary could not be examined due to download failure, so its exact behavior is unknown. This threat represents a supply chain compromise with potential for extensive dependency interception and manipulation.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 14:07 UTC

Technical details

References

Community reviews