speed2 (npm) · Malicious Code
Affects speed2Source GCVE Database
Malicious package : remove speed2 and rotate any secrets on hosts that installed it.
Data as of 12 Sep 2026, 18:17 UTC
Malicious package
Published to npm · OSV MAL-2026-10383
What to do
Remove speed2 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmspeed2 | Affected– | Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The speed2 npm package is part of a typosquatting campaign involving speed1 through speed5 packages. These packages are non-functional Node modules that bundle browser-based malicious code, including obfuscated JavaScript assets and a web proxy frontend. The package attempts to lure users via a browser popunder that opens a suspicious URL on user interaction. Although the Node.js entry point does not execute malicious code, the presence of obfuscated assets and mass-publishing scripts indicates malicious intent. Installing or running this package may fully compromise the host system.