strath (npm) · Malicious Code
Affects strathSource GCVE Database
Malicious package : remove strath and rotate any secrets on hosts that installed it.
Data as of 5 Aug 2026, 15:39 UTC
Malicious package
Published to npm · OSV MAL-2026-12805
What to do
Remove strath from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmstrath | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b9ae02b92920c1e028b5785e69013ea4662e4eb3180872531d64ccca00eef239) The package declares a postinstall script that runs dist/config.js. That script fetches JSON from https://my-api.trade-api.workers.dev?id=2 and then executes `globalThis[data.success](data.id)`, where both the method name and its argument are supplied by the remote server. This gives the operator of that endpoint arbitrary code execution on any machine that runs `npm install strath` — the invocation fires automatically as part of the default install lifecycle. The behavior is unrelated to the package's advertised path-utility purpose. The same script also references `globalThis[tag](text)` with undefined identifiers, consistent with a deliberately opaque dropper shape rather than a normal build step.