MalwarePublished 13 Jul 2026Updated 1 Sep 2026

sixseven3 (npm) · Malicious Code

Affects sixseven3Source GCVE Database

Malicious package : remove sixseven3 and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 18:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10375

What to do

Remove sixseven3 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsixseven3	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package sixseven3 contains malicious code in the form of a browser ServiceWorker and obfuscated JavaScript assets that serve a proxy site injecting unwanted ads. Installing the package does not execute code on the developer's machine due to browser-only globals, limiting immediate risk to disk usage and registry pollution. However, if the code is deployed in a browser environment, it can proxy cross-origin requests and inject popunder ads. The package is part of a name-squatting batch on npm. According to a malware source, any system with this package installed should be considered fully compromised, and all secrets should be rotated. Removal of the package alone may not eliminate all malicious software.

Impact

Installing the package in a Node.js environment does not trigger code execution, limiting risk to disk usage and npm registry pollution. However, if the package's code is deployed in a browser context, it can proxy cross-origin fetches and inject unwanted advertisements, potentially impacting end users. The malware advisory indicates that the package may lead to full system compromise, requiring secret and key rotation and thorough cleanup. This suggests the package may contain or facilitate malicious payloads beyond the described proxy functionality.

Defensive guidance

The package should be removed immediately if installed. All secrets and keys on affected systems should be rotated from a different, trusted machine. Due to potential full system compromise, comprehensive incident response and system cleanup are recommended. Developers should avoid installing or using this package and related name-squatting packages. Registry maintainers should consider removing these packages to prevent further distribution.

Summary

The sixseven3 npm package includes a browser ServiceWorker script and multiple heavily obfuscated JavaScript bundles that implement a 'web unblocker' proxy site injecting popunder ads. The package does not execute code upon installation in Node.js environments due to reliance on browser-specific globals, so developers installing it face limited risk. The package is part of a name-squatting campaign involving multiple similarly named packages. Despite limited execution risk during installation, a malware advisory states that any computer with this package installed or running should be considered fully compromised, recommending immediate secret/key rotation and removal of the package, though removal may not fully clean the system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 18:17 UTC

Technical details

References

Community reviews