MalwarePublished 17 Jun 2026Updated 11 Nov 2026

redis-type-xyz (npm) · Malicious Code

Affects redis-type-xyzSource GCVE Database

Malicious package : remove redis-type-xyz and rotate any secrets on hosts that installed it.

Data as of 11 Nov 2026, 17:35 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-11205

What to do

Remove redis-type-xyz from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmredis-type-xyz	Affected =1.10.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The redis-type-xyz npm package is a malicious impersonation of the legitimate Redis OM library. It contains no functional code but depends on a known-malicious package ulid-xyz, which installs a persistent background agent capable of system enumeration and deploying arbitrary binaries. Installing redis-type-xyz results in full system compromise, with attacker control established via a WebSocket and HTTP command-and-control server. The package should be removed immediately, and all secrets on the affected system rotated from a clean environment.

Impact

Installing redis-type-xyz results in the installation of the malicious ulid-xyz package, which establishes persistent remote access to the infected system. The attacker can collect system information, enumerate and delete files, and deploy arbitrary binaries with persistence, effectively giving full control of the system to the attacker. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately. Removal of the package alone does not guarantee eradication of the malware due to persistence mechanisms.

Defensive guidance

Remove the redis-type-xyz package immediately from all affected systems. Rotate all secrets, credentials, and keys that were stored or used on the compromised systems from a separate, clean environment. Conduct a thorough investigation and remediation of the infected systems to identify and remove all malicious components, including persistent agents deployed by the ulid-xyz package. Avoid installing packages with suspicious or impersonating names and verify package authenticity before installation.

Summary

The redis-type-xyz package is a deliberately crafted malicious npm package impersonating the official Redis OM library by copying its metadata but omitting functional code. Its only runtime effect is to pull in the ulid-xyz dependency, a known-malicious package tracked as MAL-2026-6672. The ulid-xyz package installs a postinstall hook that launches a detached background agent communicating with a C2 server at 95.216.232.162:8010. This agent can collect system information, enumerate and remove files, and deploy attacker-supplied binaries with persistence mechanisms on Windows, macOS, and Linux. The redis-type-xyz package itself does not contain payload code but acts as a delivery mechanism for the malicious ulid-xyz dependency. Systems with this package installed should be considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Nov 2026, 17:35 UTC

Technical details

References

Community reviews