tracker-cloudflare (npm) · Malicious Code
Affects tracker-cloudflareSource GCVE Database
Malicious package : remove tracker-cloudflare and rotate any secrets on hosts that installed it.
Data as of 14 Sep 2026, 00:46 UTC
Malicious package
Published to npm · OSV MAL-2026-16140
What to do
Remove tracker-cloudflare from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmtracker-cloudflare | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4) The package's preinstall hook runs `node index.js`, which collects host identifiers (os.hostname, os.userInfo, homedir, DNS servers, cwd) along with the contents of /etc/passwd and /etc/hosts, and POSTs the payload over HTTPS to the Burp Collaborator subdomain c6j5cmm8sia88v4zyhykqvhvcmid65uu.oastify.com. The package has empty description/author metadata and no legitimate functionality beyond this beacon. The exfiltration fires automatically on `npm install` before any consumer code runs.