MalwarePublished 12 Aug 2026

truecxikdsal (npm) · Malicious Code

Affects truecxikdsalSource GCVE Database

Malicious package : remove truecxikdsal and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:39 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13835

What to do

Remove truecxikdsal from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtruecxikdsal	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package truecxikdsal version 1.0.0 is identified as malicious. Although static and dynamic analysis did not reveal typical supply-chain attack behaviors such as exfiltration or backdoors, the package is considered fully compromising to any system where it is installed or running. Immediate removal and secret/key rotation from a separate, uncompromised system are strongly advised. There is no guarantee that removing the package will eliminate all malicious components due to potential full system compromise.

Impact

Any computer with truecxikdsal@1.0.0 installed or running is considered fully compromised, implying potential unauthorized control or data exposure. All secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removing the package alone may not fully remediate the compromise due to possible persistence or additional malicious software installed.

Defensive guidance

Remove the truecxikdsal@1.0.0 package immediately. Rotate all secrets and keys from a separate, uncompromised system. Because the system may be fully compromised, consider a full system rebuild or forensic analysis to ensure complete remediation.

Summary

The npm package truecxikdsal@1.0.0 contains two files and does not exhibit typical supply-chain attack patterns such as install-time code execution, credential access, or backdoors according to static and traced analysis. However, the package is flagged as malicious by GHSA-malware sources, indicating that any system with this package installed should be considered fully compromised. The package name appears unrelated to known projects and may be a placeholder or test publication. Despite the lack of direct evidence of malicious code execution, the risk is deemed severe enough to warrant full secret/key rotation and removal of the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:39 UTC

Technical details

References

Community reviews