MalwarePublished 7 Aug 2026

rdfxvela (npm) · Malicious Code

Affects rdfxvelaSource GCVE Database

Malicious package : remove rdfxvela and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:42 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13491

What to do

Remove rdfxvela from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmrdfxvela	Affected 1.0.0 – 6.2.1 28 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package rdfxvela contains embedded malicious code that includes a base64-encoded RSA private key. When users run any rx subcommand, the CLI writes this key to a temporary file and uses it to SSH into a server controlled by the package author. User passwords are also passed unescaped in remote shell commands, exposing them in process arguments and logs. The malicious access is limited to the author's infrastructure, but any system with this package installed should be considered fully compromised.

Impact

Any system with the rdfxvela package installed or running is considered fully compromised. The embedded private key allows the package author to access a remote server via SSH, and user passwords are exposed in remote command arguments and logs. Although the compromise is limited to the author's infrastructure, the package's presence indicates a severe security breach. All secrets and keys stored on the compromised system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software or backdoors that may have been installed.

Defensive guidance

Users should immediately remove the rdfxvela package from their systems. All secrets, credentials, and keys stored on affected machines must be rotated from a secure environment. Because the package grants remote access to the author's infrastructure and exposes user passwords, affected systems should be treated as fully compromised and undergo thorough incident response procedures. Monitor for any unauthorized access or persistence mechanisms resulting from this compromise.

Summary

The rdfxvela npm package embeds a base64-encoded RSA private key within its CLI code. Invoking any rx subcommand causes the CLI to decode this key, write it to a temporary file with restrictive permissions, and use it to SSH into a remote server owned by the package author. This allows the author to execute commands remotely on that server. Additionally, user-supplied passwords are interpolated unescaped into remote shell commands, exposing sensitive credentials in process arguments and logs on the remote host. The package does not exfiltrate data or execute remote code on the installer's machine, and the shared SSH credential only grants access to the author's infrastructure. However, the presence of this package on a system implies a full compromise of that system, as the author can control the remote server and potentially leverage that access maliciously.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 15:42 UTC

Technical details

References

Community reviews