MalwarePublished 26 May 2026Updated 29 Jun 2026

unleash-js (npm) · Malicious Code

Affects unleash-jsSource GCVE Database

Malicious package : remove unleash-js and rotate any secrets on hosts that installed it.

Data as of 29 Jun 2026, 22:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-4827

What to do

Remove unleash-js from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmunleash-js	Affected =99.9.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package unleash-js version 99.9.1 is a malicious stub designed to fetch and execute code from an external, mutable Google Cloud Storage bucket. This package acts as a dependency-confusion squat, pulling a payload from an untrusted source without integrity verification. Installing this package can lead to full system compromise, with attackers potentially gaining control and access to secrets and keys stored on the affected machine.

Impact

Systems that install unleash-js@99.9.1 risk full compromise as the package fetches and executes arbitrary code from an untrusted external source. Attackers may gain control over the affected system, potentially accessing or exfiltrating secrets and keys. Removing the package alone may not fully remediate the compromise due to possible persistence mechanisms installed by the malicious payload.

Defensive guidance

Immediate removal of the unleash-js@99.9.1 package is recommended. All secrets and keys on affected systems should be rotated from a secure, uncompromised environment. Due to the potential full system compromise, a thorough incident response and system rebuild may be necessary to ensure complete remediation.

Summary

The unleash-js package at version 99.9.1 is an empty stub that exports an empty object but pulls a chained dependency named ltdisafe from a third-party Google Cloud Storage bucket. The tarball URL is not controlled by the package publisher, is mutable, and unpinned by hash, allowing arbitrary code execution during npm install lifecycle scripts. This behavior is consistent with a dependency confusion attack targeting internal package names. The package communicates with a domain linked to malicious activity, and any system with this package installed should be considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Jun 2026, 22:17 UTC

Technical details

References

Community reviews