MalwarePublished 5 Aug 2026

twork-products-taiga2-products-investment (npm) · Malicious Code

Affects twork-products-taiga2-products-investmentSource GCVE Database

Malicious package : remove twork-products-taiga2-products-investment and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:19 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12305

What to do

Remove twork-products-taiga2-products-investment from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtwork-products-taiga2-products-investment	Affected =20.2.8	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'twork-products-taiga2-products-investment' version 20.2.8 contains malicious code that downloads and executes a platform-specific binary from obfuscated Cloudflare Workers hosts. This binary is saved to a disguised temporary path and executed detached from the main process. Additionally, a second malicious dropper is embedded under the guise of an analytics SDK. Installation or execution of this package results in full compromise of the host system, potentially exposing all stored secrets and keys.

Impact

Any system with this package installed or running is considered fully compromised. Attackers may have full control over the host, including access to all stored secrets and keys. Removal of the package alone does not guarantee eradication of all malicious components or persistence mechanisms.

Defensive guidance

Remove the malicious package immediately. Rotate all secrets and keys from a separate, trusted system, as the compromised host cannot be trusted. Due to the high level of compromise, consider rebuilding the affected system from a known good state.

Summary

This malicious npm package, specifically version 20.2.8 of 'twork-products-taiga2-products-investment', includes code that unconditionally fetches a platform-specific executable from obfuscated Cloudflare Workers domains and a DNS TXT record fallback. The executable is saved to a disguised temporary file with appropriate permissions and launched detached from the main process. A second embedded dropper exists in the package disguised as an analytics SDK, employing similar fetch and execution techniques. The package effectively grants full control of the compromised system to an external attacker.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:19 UTC

Technical details

References

Community reviews