MalwarePublished 5 Aug 2026Updated 25 Aug 2026

travel-core-utils-object (npm) · Malicious Code

Affects travel-core-utils-objectSource GCVE Database

Malicious package : remove travel-core-utils-object and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12487

What to do

Remove travel-core-utils-object from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtravel-core-utils-object	Affected =20.3.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package travel-core-utils-object version 20.3.4 contains malicious code that, upon loading, downloads and executes an attacker-controlled binary from a rotating set of Cloudflare Workers hosts. This binary is saved to temporary directories with disguised filenames, given executable permissions, and run with the installer's privileges. The package includes telemetry-related environment variable checks and files to disguise its true malicious behavior.

Impact

An attacker can execute arbitrary code on the system with the privileges of the user installing the package, potentially leading to full system compromise or persistence. The malicious payload is fetched dynamically from attacker-controlled infrastructure, making detection and static analysis difficult. The execution of unverified binaries poses a significant risk of unauthorized access and control.

Defensive guidance

Users should avoid using travel-core-utils-object version 20.3.4 and remove it from their environments. Monitor for any suspicious binaries in temporary directories named with the described patterns. Since the package fetches and executes unpinned binaries, blocking network access to the specified Cloudflare Workers domains and related URLs may help mitigate risk. Check vendor advisories or trusted security sources for updates or patches.

Summary

The travel-core-utils-object npm package version 20.3.4 has a malicious main entry point (index.js) that requires a side-effect module (_bridge.js). This module dynamically constructs URLs from DNS TXT records and string operations to fetch an opaque binary payload over HTTPS from multiple Cloudflare Workers domains. The binary is saved to /var/tmp or %TEMP% with disguised names, permissions are set to executable (chmod 0755), and it is executed detached via shell commands. The binary is attacker-controlled, unpinned, and unverified, running with the privileges of the user installing the package. The package attempts to mask its activity with telemetry-related environment variable checks and files, which are unrelated to its stated utility purpose.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:50 UTC

Technical details

References

Community reviews