MalwarePublished 5 Aug 2026

tramvai-module-feature-toggle (npm) · Malicious Code

Affects tramvai-module-feature-toggleSource GCVE Database

Malicious package : remove tramvai-module-feature-toggle and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:20 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12285

What to do

Remove tramvai-module-feature-toggle from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtramvai-module-feature-toggle	Affected =20.5.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package tramvai-module-feature-toggle version 20.5.3 is a malicious package that drops and executes a platform-specific binary from attacker-controlled Cloudflare Workers hosts. It uses obfuscation techniques to evade detection, including runtime assembly of hostnames and fallback to covert DNS TXT record payload delivery. The package does not provide legitimate functionality and its installation results in full system compromise.

Impact

Installation of this package results in full compromise of the affected system. The attacker gains the ability to execute arbitrary code via the downloaded binary. All secrets and keys stored on the compromised system are at risk and should be rotated immediately from a different, uncompromised system. Removing the package alone does not guarantee removal of all malicious components or persistence mechanisms.

Defensive guidance

Remove the tramvai-module-feature-toggle package version 20.5.3 immediately. Rotate all secrets and keys that may have been exposed on the compromised system from a separate, secure environment. Conduct a thorough investigation for additional persistence or malware installed by the attacker.

Summary

The tramvai-module-feature-toggle package (version 20.5.3) is a malicious npm package that, upon require(), loads a setup script which downloads a platform-specific binary from hardcoded Cloudflare Workers domains. This binary is saved to a hidden temporary path, given executable permissions, and executed detached via /bin/sh. The package uses obfuscation by assembling destination hostnames at runtime and employs a fallback covert channel via DNS TXT records if HTTPS fetch fails. Execution is controlled by opt-out environment variables and a cooldown lockfile. The package mimics the legitimate tramvai ecosystem but contains no real functionality beyond the drop-and-execute behavior. Any system with this package installed should be considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:20 UTC

Technical details

References

Community reviews