Malicious code in server-authorized-cleanup (npm)
Affects server-authorized-cleanupSource GCVE Database
Rated by Threat Radar
Data as of 09/09/2026, 13:54:36 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmserver-authorized-cleanup | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should immediately cease using server-authorized-cleanup version 1.1.0 and remove it from their projects. Avoid invoking triggerCleanup() or any related API. Monitor vendor advisories for updates or fixes. Since the package contains a hardcoded remote kill switch, it is recommended to replace it with a trusted alternative or implement local cleanup logic without remote control.
Description
The server-authorized-cleanup npm package version 1.1.0 contains a malicious feature where a remote server controls whether a destructive cleanup operation is performed on the local working directory. The package exposes a triggerCleanup() function that sends an HTTPS GET request to a hardcoded author-controlled endpoint with a hardcoded API key. If the response indicates permission, the package recursively deletes all files and directories under the current working directory. This effectively gives the remote server a kill switch over the user's filesystem within the working directory.
Impact
Any consumer of the server-authorized-cleanup package version 1.1.0 that calls triggerCleanup() risks complete deletion of their current working directory and all its contents if the remote server authorizes the cleanup. This can lead to significant data loss and disruption of operations. The destructive action is triggered remotely without user control or configuration, making it a severe security risk.