MalwarePublished 6 Aug 2026Updated 12 Aug 2026

tsihealth-client (npm) · Malicious Code

Affects tsihealth-clientSource GCVE Database

Malicious package : remove tsihealth-client and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:10 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13404

What to do

Remove tsihealth-client from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtsihealth-client	Affected 1.0.0 – 1.0.3 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (554372f29af60ad8e6e5a33171a736baddcc652772b0452c81a4010d3f1e5218) index.js is a top-level self-decoding IIFE that XOR-decodes a URI-encoded payload keyed on the enclosing function's own source and eval()s the result at module load; the decoder aborts with 'the code has been tampered!' if the source is modified, and a banner asks readers not to crack it. The decoded payload is opaque and cannot be audited without executing it. The package's own metadata and typings describe the runtime behavior: package.json advertises it as a 'client (provider) for the tsi-vpsremote control server' that 'stays alive to run commands pushed from the server', keywords include 'shell', 'ssh', 'remote-control', and 'agent', and index.d.ts exports a ProviderHandle exposing a ChildProcess named `shell`. Calling the exported provider(url) at runtime therefore establishes a persistent connection to a remote server that drives a local ChildProcess on the host running the package — a network-to-shell control channel with full-host command execution for whoever controls the paired server URL. ## Source: ghsa-malware (3437dfe049006b09ad2f66c94d934907ac32e7272a22ad75694179e136ac90a8) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Impact

The malicious code enables an attacker controlling the remote server URL to execute arbitrary commands on the host running the tsihealth-client package. This results in a full remote shell with persistent network access, effectively compromising the host system. The impact includes unauthorized control, potential data theft, system manipulation, and further malware deployment. No known exploits in the wild have been reported, but the presence of such a backdoor represents a critical security risk.

Defensive guidance

Users should immediately remove tsihealth-client versions 1.0.0 through 1.0.3 from their environments and avoid installing this package. Investigate any systems where this package was used for signs of compromise. Consider blocking the package from internal repositories and monitoring for attempts to install it. Since this is a malicious package, remediation involves removal and prevention rather than patching.

Summary

The tsihealth-client npm package (versions 1.0.0, 1.0.1, 1.0.2, and 1.0.3) contains a top-level self-decoding Immediately Invoked Function Expression (IIFE) that XOR-decodes a URI-encoded payload keyed on the function's own source code. This decoded payload is executed via eval() at module load time. The decoder includes anti-tampering logic that aborts execution if the source is modified. The package metadata describes it as a client for a remote control server that maintains a persistent connection to receive and execute commands. The exported provider function establishes a network-to-shell control channel, spawning a local ChildProcess shell that allows full command execution by whoever controls the remote server URL. This behavior constitutes malicious code embedded in the package, enabling remote code execution under the control of an attacker.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 18:37 UTC

Technical details

References

Community reviews