MalwarePublished 5 Aug 2026

saas-f-lego-landings (npm) · Malicious Code

Affects saas-f-lego-landingsSource GCVE Database

Malicious package : remove saas-f-lego-landings and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 17:35 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12433

What to do

Remove saas-f-lego-landings from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsaas-f-lego-landings	Affected =20.7.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package saas-f-lego-landings version 20.7.5 contains malicious code that executes a native binary dropper upon loading. This dropper fetches a platform-specific executable from obfuscated Cloudflare Workers hosts or via a DNS TXT-record fallback, writes it to temporary directories with deceptive filenames, sets executable permissions, and runs it detached. The package also includes a large telemetry-like module with similar dropper behavior, supporting the presence of a staged loader. These behaviors indicate intentional malicious activity rather than legitimate functionality.

Impact

This malicious package can execute arbitrary native code on the host system without user consent, potentially leading to full system compromise or persistence. The staged loader design and multi-mirror command and control infrastructure increase the difficulty of detection and removal. Although no known exploits in the wild are reported, the presence of a native dropper capable of executing arbitrary binaries poses a high risk to affected systems.

Defensive guidance

Users should immediately remove saas-f-lego-landings@20.7.5 from their environments and avoid installing or using this package. Employ package integrity verification and source validation to prevent installation of malicious npm packages. Monitor for any suspicious processes spawned from temporary directories with deceptive names. Check vendor or npm advisories for updates or removal notices.

Summary

The npm package saas-f-lego-landings@20.7.5 unconditionally loads a support script that dynamically reconstructs obfuscated hostnames to fetch a native executable over HTTPS from multiple mirrored endpoints. It writes this executable to temporary locations with deceptive names, sets permissions to executable, and spawns it detached using shell commands. The package also contains a telemetry module that implements similar base64 decoding, writing, permission setting, and spawning of executables, reinforcing the presence of a multi-stage loader. The use of DNS TXT-record fallback channels, runtime string reconstruction, and environment variable opt-out mechanisms are evasion techniques consistent with malicious intent.

References

npmjs.com/package/saas-f-lego-landings/v/20.7.5 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:35 UTC

Technical details

References

Community reviews