MalwarePublished 8 Aug 2026Updated 10 Aug 2026

specials-resources-server (npm) · Malicious Code

Affects specials-resources-serverSource GCVE Database

Malicious package : remove specials-resources-server and rotate any secrets on hosts that installed it.

Data as of 10 Aug 2026, 15:59 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13669

What to do

Remove specials-resources-server from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmspecials-resources-server	Affected =35.8.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package specials-resources-server version 35.8.1 is a malicious package that acts as a staged remote code execution dropper disguised as an analytics SDK. Upon import, it fetches and executes a binary payload from anonymous Cloudflare Workers subdomains without integrity verification, writing it to temporary directories and executing it with elevated privileges. This behavior results in full system compromise. Immediate removal and secret rotation are advised, but full remediation cannot be guaranteed due to potential persistent compromise.

Impact

Systems with specials-resources-server@35.8.1 installed or running are fully compromised, allowing an attacker to execute arbitrary code remotely. This can lead to complete system takeover, theft of secrets and keys, and persistent backdoors. The malicious payload runs with the privileges of the importing process and can evade detection through obfuscation and execution gating. Removal of the package alone does not guarantee eradication of the compromise.

Defensive guidance

Remove the specials-resources-server package version 35.8.1 immediately from all affected systems. Rotate all secrets and keys that were stored or accessible on compromised systems using a separate, clean environment. Due to the potential for persistent compromise, conduct a thorough incident response and forensic analysis to identify and eradicate any additional malicious artifacts. Monitor for any suspicious activity related to this package. Avoid using this package and audit dependencies for similar malicious code.

Summary

specials-resources-server@35.8.1 is a malicious npm package that executes a remote code execution payload upon being required. It fetches an opaque binary from a rotating set of Cloudflare Workers subdomains, using DNS TXT record fallbacks, decodes and writes the payload to temporary files with names mimicking cache or diagnostic files, sets executable permissions, and spawns the process detached from the parent. The package uses string concatenation and array joins to evade static detection. The payload execution is gated by a TTL marker file to avoid repeated execution. There is no signature or hash verification of the downloaded payload, allowing arbitrary code execution. Any system importing this package is considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Aug 2026, 15:59 UTC

Technical details

References

Community reviews