runhelper (npm) · Malicious Code
Affects runhelperSource GCVE Database
Malicious package : remove runhelper and rotate any secrets on hosts that installed it.
Data as of 30 Sep 2026, 16:38 UTC
Malicious package
Published to npm · OSV MAL-2026-17332
What to do
Remove runhelper from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmrunhelper | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'runhelper' version 1.0.0 contains malicious code that, upon being required, loads and executes a native payload disguised as a .jpg file. This payload is staged by its dependency 'imgbundle' and executed in-memory on Windows systems using kernel32 API calls via the 'koffi' FFI. The payload file is deleted after execution, and the module suppresses all errors, hiding its true behavior. The advertised functionality is a cover story; the actual behavior is the execution of attacker-supplied native code in-process.