spectral-core (npm) · Malicious Code
Affects spectral-coreSource GCVE Database
Malicious package : remove spectral-core and rotate any secrets on hosts that installed it.
Data as of 29 Oct 2026, 18:52 UTC
Malicious package
Published to npm · OSV MAL-2026-18377
What to do
Remove spectral-core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmspectral-core | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
A malicious npm package named spectral-core impersonates a legitimate project and executes code during installation to steal sensitive environment variables and AWS EC2 metadata. It collects CI/CD secrets, cloud credentials, network reconnaissance data, and sends this information to a hardcoded external server. The package contains no functional library code and uses a binding.gyp file solely to run the malicious script at install time.
References
- npmjs.com/package/spectral-core/v/3.0.6 (opens in a new tab)
- npmjs.com/package/spectral-core/v/3.0.4 (opens in a new tab)
- npmjs.com/package/spectral-core/v/3.0.10 (opens in a new tab)
- npmjs.com/package/spectral-core/v/3.0.5 (opens in a new tab)
- npmjs.com/package/spectral-core/v/3.0.3 (opens in a new tab)
- npmjs.com/package/spectral-core/v/3.0.11 (opens in a new tab)
- npmjs.com/package/spectral-core/v/3.0.7 (opens in a new tab)
- npmjs.com/package/spectral-core/v/3.0.12 (opens in a new tab)
- npmjs.com/package/spectral-core/v/3.0.9 (opens in a new tab)
- npmjs.com/package/spectral-core/v/3.0.2 (opens in a new tab)