MalwarePublished 26 May 2026Updated 29 Jun 2026

test-nonmal-pkg-5 (npm) · Malicious Code

Affects test-nonmal-pkg-5Source GCVE Database

Malicious package : remove test-nonmal-pkg-5 and rotate any secrets on hosts that installed it.

Data as of 29 Jun 2026, 22:18 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-4785

What to do

Remove test-nonmal-pkg-5 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtest-nonmal-pkg-5	Affected =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'test-nonmal-pkg-5' version 1.0.1 contains malicious code that exfiltrates environment variables by sending them via an obfuscated HTTP POST request upon import. The exfiltration target is currently a loopback address, preventing data leakage in normal environments, but the code is designed to be easily modified to target external hosts. The package also includes deceptive comments and user-agent strings intended to mislead automated security reviewers. Installation of this package compromises the host, potentially exposing all stored secrets and keys.

Impact

Any system with this package installed or running is considered fully compromised. All secrets and keys accessible via environment variables may be exposed. Because the package executes code on import that sends environment data externally, attackers could gain unauthorized access to sensitive information. Removal of the package does not guarantee full remediation, as the attacker may have established persistent control or installed additional malicious software.

Defensive guidance

Immediate removal of 'test-nonmal-pkg-5' version 1.0.1 is strongly recommended. All secrets and keys stored on the compromised system should be rotated from a separate, trusted environment. Treat any system with this package as fully compromised and conduct a thorough security assessment to identify and remove any additional malicious artifacts.

Summary

The 'test-nonmal-pkg-5' npm package version 1.0.1 includes an obfuscated payload that, when imported, enumerates all environment variables and sends them as JSON to a specified HTTP endpoint. Although the current endpoint is a local loopback address (127.0.0.1:4000), the obfuscation and code structure indicate intent to exfiltrate sensitive data. The package contains explicit hostile indicators such as misleading comments and a crafted HTTP User-Agent string to evade detection. This behavior constitutes an active attack vector, compromising any system where the package is installed or executed.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Jun 2026, 22:18 UTC

Technical details

References

Community reviews