tinyparrot (npm) · Malicious Code
Affects tinyparrotSource GCVE Database
Malicious package : remove tinyparrot and rotate any secrets on hosts that installed it.
Data as of 26 Oct 2026, 15:56 UTC
Malicious package
Published to npm · OSV MAL-2026-10190
What to do
Remove tinyparrot from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmtinyparrot | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ec7ebbcc82edaa241764193ea85c0492b99f9ed3be805c57ef0914518cd4b6f9) The postinstall script src/build.js reconstructs the strings 'https', 'POST', and the destination host 'rnjkerbf.org/P' from integer-encoded arrays via base-decoders in src/const.js and src/helpers.js, then dynamically requires the resolved module and issues an HTTPS POST to https://rnjkerbf.org/P. The value of the response header 'm' is passed directly to child_process.execSync, so arbitrary shell commands returned by the attacker-controlled server run on the installer's machine at 'npm install' time. Errors are swallowed by try/catch to hide failures. The URL, HTTP method, and required module name are all hidden behind numeric-literal decoders to evade static inspection.