MalwarePublished 18 Oct 2025Updated 31 Oct 2025

shopifyql-parser (npm) · Malicious Code

Affects shopifyql-parserSource GCVE Database

Malicious package : remove shopifyql-parser and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 23:22 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-48463

What to do

Remove shopifyql-parser from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmshopifyql-parser	Affected =1.110.1 =20.110.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The 'shopifyql-parser' npm package version 1.110.1 and 20.110.1 has been identified as malicious. It communicates with domains linked to malicious activity and executes commands associated with harmful behavior. Any system with this package installed should be considered fully compromised, and all stored secrets and keys should be rotated from a secure device. Removing the package alone may not eliminate all malicious software introduced by it.

Impact

Systems with the affected versions of 'shopifyql-parser' installed are considered fully compromised. Attackers may have gained control over the system, potentially accessing or exfiltrating secrets and keys stored on the device. The presence of this package poses a severe security risk, as it may enable unauthorized command execution and communication with malicious infrastructure.

Defensive guidance

Immediate removal of the 'shopifyql-parser' package versions 1.110.1 and 20.110.1 is recommended. All secrets and keys stored on the compromised system should be rotated from a different, secure device. Due to the likelihood of full system compromise, further forensic analysis and remediation may be necessary to ensure complete removal of malicious software.

Summary

The 'shopifyql-parser' package versions 1.110.1 and 20.110.1 on npm have been flagged as malicious by the OpenSSF Package Analysis project and GHSA malware sources. The package exhibits malicious behavior by communicating with known malicious domains and executing commands that facilitate compromise. Systems with this package installed are at high risk of full compromise, potentially allowing attackers to gain control and access sensitive information.

References

github.com/advisories/GHSA-gwcm-r6hx-fmr2 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 23:22 UTC

Technical details

References

Community reviews