@sectest429/hello-npm-world (npm) · Malicious Code
Affects @sectest429/hello-npm-worldSource GCVE Database
Malicious package : remove @sectest429/hello-npm-world and rotate any secrets on hosts that installed it.
Data as of 12 Sep 2026, 15:33 UTC
Malicious package
Published to npm · OSV MAL-2026-10478
What to do
Remove @sectest429/hello-npm-world from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@sectest429/hello-npm-world | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package @sectest429/hello-npm-world version 1.0.3 contains malicious code in its preinstall lifecycle script. This script executes automatically during installation and performs unauthorized reconnaissance by collecting system information including OS username, hostname, platform/architecture, running processes, and cloud instance metadata. The collected data is written to a local file named exfil.log. Although the current version does not transmit data externally, the behavior is unrelated to the package's advertised functionality and indicates a trojanized package with code execution at install time. The package should be considered fully compromised and removed.
References
- npmjs.com/package/@sectest429/hello-npm-world/v/1.0.3 (opens in a new tab)
- github.com/advisories/GHSA-q7w2-749v-c98p (opens in a new tab)
- npmjs.com/package/@sectest429/hello-npm-world/v/1.0.2 (opens in a new tab)
- npmjs.com/package/@sectest429/hello-npm-world/v/1.0.1 (opens in a new tab)
- npmjs.com/package/@sectest429/hello-npm-world/v/1.0.0 (opens in a new tab)