MalwarePublished 5 Aug 2026Updated 6 Aug 2026

uzair-rajput-new (npm) · Malicious Code

Affects uzair-rajput-newSource GCVE Database

Malicious package : remove uzair-rajput-new and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 07:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13360

What to do

Remove uzair-rajput-new from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmuzair-rajput-new	Affected 1.0.1 – 1.3.0 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'uzair-rajput-new' contains malicious code concealed in its CommonJS (CJS) entrypoint. It reconstructs an AES-256-CBC decryption key by reading and XORing byte arrays from sibling files, then decrypts and executes an embedded payload at runtime. This behavior is hidden from static analysis and diverges from the benign ESM entrypoint, indicating deliberate obfuscation. Every require() call executes attacker-controlled code with the host process's privileges, posing a serious security risk.

Impact

Any system or developer that installs and requires the affected versions of this package will execute attacker-controlled code with the same privileges as the Node.js process. This can lead to arbitrary code execution, potential system compromise, data theft, or further malware deployment. The malicious payload is concealed and dynamically decrypted, evading static detection methods.

Defensive guidance

Users should immediately avoid using the affected versions of the 'uzair-rajput-new' package (=1.0.1, =1.1.0, =1.2.0, =1.3.0). Remove these versions from projects and replace them with trusted alternatives. Monitor dependency sources carefully and verify package integrity before installation. Check vendor advisories or trusted security databases for updates or patches.

Summary

The 'uzair-rajput-new' npm package masquerades as a color-gradient utility but embeds malicious code in its CJS main entrypoint. It reconstructs an AES-256-CBC key by XORing byte arrays from three sibling files with constants, concatenates the results, and derives a key via scryptSync with a fixed IV. This key decrypts a large base64-encoded payload, which is then executed dynamically using the Function constructor. The ESM entrypoint remains benign, indicating intentional concealment of malicious behavior in the CJS module. This design enables execution of attacker-controlled code with the privileges of the requiring process on every import.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 07:43 UTC

Technical details

References

Community reviews