MalwarePublished 14 Jul 2026Updated 5 Aug 2026

@tqm-mfe/main (npm) · Malicious Code

Affects @tqm-mfe/mainSource GCVE Database

Malicious package : remove @tqm-mfe/main and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10517

What to do

Remove @tqm-mfe/main from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@tqm-mfe/main	Affected =5.4.7 =5.5.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @tqm-mfe/main version 5.4.7 contains malicious code in its postinstall.js lifecycle script. This script is heavily obfuscated and executes automatically on npm install. It performs environment checks to evade sandbox detection, downloads a remote binary payload, decrypts it, writes it to a persistent app-data directory, marks it executable, and runs it detached from the installer process. Additionally, it sends system information to a remote server. The package metadata is deceptive, mimicking an internal corporate mirror but is actually a dependency-confusion lure. This behavior is unrelated to the package's advertised functionality.

Impact

This malicious package can lead to unauthorized code execution on the affected system, persistent installation of unknown binaries, and exfiltration of system information to an attacker-controlled server. This compromises system integrity and confidentiality. The obfuscation and sandbox evasion techniques increase the difficulty of detection and analysis.

Defensive guidance

The best mitigation is to avoid installing version 5.4.7 of @tqm-mfe/main from public npm registries. Organizations should audit their dependencies for this package and remove it if found. Use strict package source controls and consider implementing dependency allowlists or private registries to prevent dependency confusion attacks. Monitor for unexpected postinstall scripts in npm packages.

Summary

The @tqm-mfe/main npm package at version 5.4.7 includes a malicious postinstall.js script that uses advanced obfuscation techniques to evade detection. Upon installation, it verifies the environment to avoid sandbox analysis, fetches a remote encrypted binary, decrypts and installs it persistently on the system, and executes it in a detached manner to maintain persistence beyond the npm process. Concurrently, it exfiltrates system metadata to a remote server. The package's public metadata falsely represents it as an internal corporate tool, consistent with a dependency confusion attack vector targeting organizations that might resolve the @tqm-mfe scope from the public npm registry. None of these actions are required for the purported API mocking middleware functionality.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:39 UTC

Technical details

References

Community reviews