MalwarePublished 23 Jun 2026Updated 26 Jun 2026

theme-color-picker (npm) · Malicious Code

Affects theme-color-pickerSource GCVE Database

Malicious package : remove theme-color-picker and rotate any secrets on hosts that installed it.

Data as of 26 Jun 2026, 22:33 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6357

What to do

Remove theme-color-picker from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtheme-color-picker	Affected =2.0.28 =2.0.31 =2.0.30	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'theme-color-picker' versions 2.0.28, 2.0.30, and 2.0.31 contains malicious code masquerading as a color picker. Instead of its stated functionality, it includes a Windows dropper that downloads, decrypts, and executes a malicious DLL with persistence via a scheduled task named 'WindowsUpdateService'. The package self-removes from node_modules and the root package.json to evade detection. Systems running npm install on these versions are fully compromised.

Impact

Installation of affected versions on Windows systems leads to execution of attacker-controlled native code with persistence and elevated privileges. The attacker gains full control over the compromised system. Secrets and keys stored on the system may be exposed. The package attempts to hide its presence by self-removal and manifest modification, complicating detection and remediation.

Defensive guidance

Users should immediately remove the affected package versions (=2.0.28, =2.0.30, =2.0.31) from their projects. Because the malicious payload establishes persistence and full system compromise is likely, affected machines should be considered fully compromised. It is strongly recommended to perform a full system forensic analysis and reinstallation from a trusted source. All secrets and keys stored on the compromised machine must be rotated from a different, secure device. Monitor for suspicious scheduled tasks named 'WindowsUpdateService' and remove them if found. Avoid using this package or any versions from the publisher 'analysis-chart.io'.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Jun 2026, 22:33 UTC

Technical details

References

Community reviews