MalwarePublished 19 May 2026Updated 6 Nov 2026

sickle-wrapper (npm) · Malicious Code

Affects sickle-wrapperSource GCVE Database

Malicious package : remove sickle-wrapper and rotate any secrets on hosts that installed it.

Data as of 6 Nov 2026, 07:35 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-4178

What to do

Remove sickle-wrapper from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsickle-wrapper	Affected =0.2.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'sickle-wrapper' version 0.2.0 has been identified as malicious. It communicates with a domain linked to malicious activity, indicating potential compromise. Any system with this package installed or running should be considered fully compromised, and all secrets and keys stored on that system should be rotated immediately from a separate, secure device. Removing the package alone may not eliminate all malicious software introduced by it.

Impact

Systems with 'sickle-wrapper' version 0.2.0 installed or running are considered fully compromised. Attackers may have gained full control over the affected system, risking exposure of all stored secrets and keys. The malicious package's communication with a known malicious domain indicates potential data exfiltration or command and control activity.

Defensive guidance

Remove the 'sickle-wrapper' package version 0.2.0 immediately from all affected systems. Rotate all secrets and keys stored on compromised systems from a separate, secure device. Due to the likelihood of full system compromise, consider performing a full system audit and remediation beyond package removal to ensure all malicious artifacts are eradicated.

Summary

The 'sickle-wrapper' npm package version 0.2.0 is flagged as malicious by the OpenSSF Package Analysis project and the GHSA malware source. The package exhibits malicious behavior by communicating with a domain associated with malicious activity. This behavior suggests that the package may provide unauthorized external access or data exfiltration capabilities. Systems with this package installed are at high risk of full compromise, necessitating immediate secret rotation and package removal. However, due to potential persistent threats, removal of the package may not fully restore system integrity.

References

github.com/advisories/GHSA-f64g-9rx5-4jxf (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 07:35 UTC

Technical details

References

Community reviews