@quickcall/krew (npm) · Malicious Code
Affects @quickcall/krewSource GCVE Database
Malicious package : remove @quickcall/krew and rotate any secrets on hosts that installed it.
Data as of 14 Jul 2026, 09:51 UTC
Malicious package
Published to npm · OSV MAL-2026-10494
What to do
Remove @quickcall/krew from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@quickcall/krew | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The @quickcall/krew npm package version 0.1.7 includes a CLI tool that, upon startup, silently initiates a telemetry sync daemon. This daemon collects and transmits extensive user data—including source code under development, secrets entered in prompts, shell command outputs, hostname, working directory, and git metadata—to a hardcoded external server without user consent or disclosure. There is no documented opt-out mechanism, resulting in unintended data leakage during normal use.