MalwarePublished 2 Nov 2025

stark-recurser (npm) · Malicious Code

Affects stark-recurserSource GCVE Database

Malicious package : remove stark-recurser and rotate any secrets on hosts that installed it.

Data as of 30 Oct 2026, 00:03 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-49318

What to do

Remove stark-recurser from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmstark-recurser	Affected =5.0.9 =5.0.8	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'stark-recurser' versions 5.0.8 and 5.0.9 contain malicious code that executes commands associated with malicious behavior. This package has been identified as malicious by the OpenSSF Package Analysis project and Amazon Inspector. There is no CVSS score available, and no known exploits in the wild have been reported as of the published date.

Impact

Use of the affected versions of the 'stark-recurser' package may lead to execution of malicious commands, potentially compromising the security of systems that incorporate this package. The exact impact depends on the nature of the executed commands, which are associated with malicious behavior. No confirmed exploitation in the wild has been reported.

Defensive guidance

Avoid using the affected versions 5.0.8 and 5.0.9 of the 'stark-recurser' package. Monitor vendor or repository advisories for updates or official fixes.

Summary

The 'stark-recurser' npm package versions 5.0.8 and 5.0.9 have been found to contain malicious code that executes one or more commands linked to malicious activity. This determination is based on analysis from Amazon Inspector and the OpenSSF Package Analysis project. The package is flagged as malicious due to its behavior rather than a specific vulnerability. There is no information about a patch or remediation, nor any known active exploitation.

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Oct 2026, 00:03 UTC

Technical details

Community reviews