MalwarePublished 12 Aug 2026

unitel4 (npm) · Malicious Code

Affects unitel4Source GCVE Database

Malicious package : remove unitel4 and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:39 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13838

What to do

Remove unitel4 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmunitel4	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'unitel4' version 1.0.0 contains malicious code in the form of an HTML file that impersonates a Cloudflare interstitial page. When served to an end-user browser, it executes obfuscated JavaScript that redirects the user to a suspicious '.club' domain, indicating registry abuse for phishing or cloaking purposes. The malicious payload does not execute in Node.js environments during installation or runtime, so it is not a direct supply-chain attack on developers. However, any system running this package should be considered fully compromised due to potential backdoors or additional malware. Immediate removal and secret/key rotation are recommended.

Impact

The malicious HTML payload causes end-user browsers to be redirected to potentially harmful phishing or cloaking domains, posing a risk to users interacting with the package's served content. Although the package does not execute malicious code in Node.js environments, the presence of this package on a system indicates possible full compromise, as attackers may have used it as a foothold to deploy additional malware or backdoors. Therefore, all secrets and keys on affected systems should be rotated immediately. The package's presence undermines trust and may facilitate phishing campaigns or other malicious activities targeting end users.

Defensive guidance

Remove the 'unitel4' package version 1.0.0 from all systems. Immediately rotate all secrets and keys stored on affected computers from a separate, trusted device. Since the package's malicious payload triggers only when the HTML is served to browsers, ensure that any web servers or services serving this content are cleaned and secured. Monitor for any signs of further compromise or persistence mechanisms installed alongside this package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:39 UTC

Technical details

References

Community reviews