MalwarePublished 19 Sep 2026Updated 8 Oct 2026

radio-player-theme (npm) · Malicious Code

Affects radio-player-themeSource GCVE Database

Malicious package : remove radio-player-theme and rotate any secrets on hosts that installed it.

Data as of 8 Oct 2026, 07:50 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-16347

What to do

Remove radio-player-theme from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmradio-player-theme	Affected 0.0.0-stage – 6.0.0 7 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'radio-player-theme' version 6.0.0 contains a malicious payload in its 'payload.js' file that, when loaded in a browser, reads the origin and a specific XSRF cookie from the victim's environment and exfiltrates this data to an external domain under oastify.com. The package does not execute this code during installation but only when the JavaScript is loaded in a browser context, enabling data collection through a CSP bypass proof-of-concept. The package has no legitimate functionality beyond this data-exfiltration behavior.

Impact

Any environment that loads the 'payload.js' file from this package in a browser context risks leaking sensitive information such as the origin and an XSRF token cookie to an attacker-controlled domain. This can lead to unauthorized access or manipulation of third-party services that rely on the stolen token. While the package does not execute code on installation, its presence in a web application or CDN can facilitate client-side compromise and data leakage.

Defensive guidance

Remove the 'radio-player-theme' package version 6.0.0 from all projects and environments. Rotate any secrets or keys that may have been exposed due to the exfiltration of the XSRF token. Since the malicious code only executes when loaded in a browser, ensure that no web applications or CDNs serve this package's JavaScript to end users. Monitor for any usage of this package and block or audit its presence.

Summary

The 'radio-player-theme' npm package version 6.0.0 includes a browser payload in 'payload.js' that reads 'location.origin' and the 'MANAGER-XSRF-TOKEN' cookie, sending this information to an external callback domain (oastify.com) via an image beacon. It also performs an authenticated request to a third-party manager API and stores the collected data in a global window variable. The package does not run this code during npm install or require(), but only when the JavaScript is loaded in a browser, typically via CDN delivery. This behavior constitutes a malicious data-exfiltration mechanism masquerading as a theme package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Sep 2026, 16:37 UTC

Technical details

References

Community reviews