MalwarePublished 13 Jul 2026

type-context (npm) · Malicious Code

Affects type-contextSource GCVE Database

Malicious package : remove type-context and rotate any secrets on hosts that installed it.

Data as of 14 Jul 2026, 09:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10440

What to do

Remove type-context from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmtype-context	Affected 3.2.7 – 3.2.11 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'type-context' versions 3.2.7, 3.2.8, 3.2.9, and 3.2.11 contains malicious code that executes attacker-controlled JavaScript on the host. When imported and used, it runs a detached Node child process that fetches code from remote paste-style services and executes it with full module loader privileges. This allows an attacker to gain full control over the compromised system. Removal of the package does not guarantee elimination of all malicious software installed via this backdoor. Immediate secret and key rotation is recommended for affected systems.

Impact

Systems with the affected 'type-context' package versions installed are fully compromised, as the package executes attacker-controlled code with full Node.js module privileges. This can lead to unauthorized access, data theft, persistence of malicious software, and complete loss of system integrity. Secrets and keys stored on compromised systems are at risk and should be considered exposed.

Defensive guidance

Immediate removal of the 'type-context' package versions 3.2.7, 3.2.8, 3.2.9, and 3.2.11 is strongly recommended. Because the package grants full control to attackers, assume the system is fully compromised and perform a comprehensive incident response, including secret and key rotation from a secure environment. Monitor for any persistence mechanisms or additional malware.

Summary

The 'type-context' npm package masquerades as a logger but contains malicious code that executes arbitrary JavaScript fetched from hardcoded remote endpoints. Specifically, upon invocation of its middleware factory, it spawns a detached Node.js child process running 'lib/caller.js', which retrieves JSON data from an attacker-controlled URL. It extracts a 'cookie' field from the response and executes it as JavaScript code using the Function constructor with the Node 'require' function injected, granting full module loading capabilities. The package also uses obfuscated fallback URLs encoded in environment variables to evade detection. The remote code is mutable and hosted on anonymous paste services, enabling attackers to execute any code on the host machine. This results in a full compromise of any system running this package version.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:54 UTC

Technical details

References

Community reviews