tracker-radar-detector (npm) · Malicious Code
Affects tracker-radar-detectorSource GCVE Database
Malicious package : remove tracker-radar-detector and rotate any secrets on hosts that installed it.
Data as of 12 Sep 2026, 07:01 UTC
Malicious package
Published to npm · OSV MAL-2026-12483
What to do
Remove tracker-radar-detector from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmtracker-radar-detector | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package tracker-radar-detector version 1.0.1 contains malicious code that executes automatically during installation. The malicious script collects sensitive system information including hostname, OS username, home directory, DNS server list, and reads /etc/passwd and /etc/hosts files if present. This data is then sent via HTTPS POST to an attacker-controlled out-of-band callback domain unrelated to the package's intended functionality.