MalwarePublished 5 Aug 2026

scandoc-scandoc-core (npm) · Malicious Code

Affects scandoc-scandoc-coreSource GCVE Database

Malicious package : remove scandoc-scandoc-core and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:27 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12191

What to do

Remove scandoc-scandoc-core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmscandoc-scandoc-core	Affected =20.8.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package scandoc-scandoc-core version 20.8.5 contains malicious code that downloads and executes platform-specific binaries from dynamically constructed Cloudflare Workers hostnames. It uses covert DNS-TXT record channels to fetch payloads, writes them to temporary locations disguised as legitimate .NET diagnostic files, and executes them detached from the main process. The package includes a secondary dropper module masquerading as an analytics SDK with similar malicious behavior. Any system with this package installed or running should be considered fully compromised, and all secrets and keys on the system must be rotated immediately from a different machine.

Impact

Systems with this package installed or running are fully compromised, allowing an attacker to execute arbitrary code with the privileges of the user running the package. This can lead to complete system takeover, unauthorized access to secrets and keys, and persistent malicious activity. Removal of the package alone does not guarantee eradication of all malicious components, as the attacker may have established additional footholds.

Defensive guidance

Immediate removal of the scandoc-scandoc-core package version 20.8.5 is required. All secrets, keys, and credentials stored on the compromised system must be rotated from a separate, trusted machine. Due to the high likelihood of full system compromise, a full system forensic analysis and potential rebuild is recommended. Monitor vendor advisories for any updates or remediation guidance.

Summary

The scandoc-scandoc-core npm package (version 20.8.5) includes malicious code that, upon require(), loads a vendor script which fetches platform-specific binaries from Cloudflare Workers hostnames reconstructed at runtime. It also uses a DNS-TXT covert channel fallback to retrieve base64-encoded payloads. These payloads are saved to temporary files named to resemble legitimate .NET diagnostic artifacts, given executable permissions, and executed detached from the main process. Execution is controlled by environment variables and a freshness marker to limit re-execution. Additionally, a secondary dropper module named telemetry.js is included, which uses obfuscated child process spawning to execute further payloads under the guise of an analytics SDK. This behavior effectively grants full control of the compromised system to an attacker.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:27 UTC

Technical details

References

Community reviews