MalwarePublished 9 Jul 2026

pxpure8 (npm) · Malicious Code

Affects pxpure8Source GCVE Database

Malicious package : remove pxpure8 and rotate any secrets on hosts that installed it.

Data as of 11 Jul 2026, 09:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10105

What to do

Remove pxpure8 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpxpure8	Affected =1.0.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a40ae433e9fa90bfbb449d343c281375329a44c0dacf080a91a0c1717579b679) The package's main entry (pure.js) consists of a single behavior: it creates a <script> element pointing at https://cdn.jsdelivr.net/npm/px8my/px.js (no version pin) and appends it to document.head. When the module is required/imported in any browser-like environment (browser bundling, jsdom, Electron renderer), this causes arbitrary JavaScript from the unrelated `px8my` npm package — at whatever version its owner most recently published — to execute in the host page context. The destination is a different publisher's package, the version is unpinned (so the executed bytes are author-mutable at any time by a third party), and there is no documented purpose for this loader behavior. Package metadata reinforces the loader/lure shape: empty author, empty description, no repository, default test script — a throwaway package whose only function is to pull in remote third-party code. An installer that bundles or loads pxpure8 ends up shipping whatever px8my publishes, including any future malicious version, into their own application's execution context.

Impact

Applications that include or bundle pxpure8 version 1.0.2 will execute arbitrary JavaScript controlled by the px8my package owner in their runtime environment. This can lead to compromise of the application's integrity, data leakage, or further malicious activity depending on the code served by px8my. Because the loaded code is unpinned, the risk persists indefinitely and can escalate if px8my publishes malicious updates.

Defensive guidance

Users should immediately remove pxpure8 version 1.0.2 from their dependencies and avoid including it in any builds or deployments. Since the package dynamically loads untrusted remote code, it should be considered malicious and untrusted. Monitor vendor advisories for any updates or official guidance.

Summary

The pxpure8 npm package (version 1.0.2) includes a main script that injects a <script> element pointing to https://cdn.jsdelivr.net/npm/px8my/px.js without version pinning. This causes arbitrary JavaScript from the unrelated px8my package to execute in the context of any browser-like environment that imports pxpure8. The unpinned dependency allows the px8my package owner to change the executed code at any time, potentially introducing malicious behavior. The lack of author information, description, repository, and meaningful metadata suggests pxpure8 is a malicious package intended to load remote code dynamically, posing a supply chain threat to applications that include it.

References

npmjs.com/package/pxpure8/v/1.0.2 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 09:34 UTC

Technical details

References

Community reviews