verify-cli (npm) · Malicious Code
Affects verify-cliSource GCVE Database
Malicious package : remove verify-cli and rotate any secrets on hosts that installed it.
Data as of 12 Aug 2026, 16:33 UTC
Malicious package
Published to npm · OSV MAL-2026-13882
What to do
Remove verify-cli from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmverify-cli | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'verify-cli' version 99.0.0 contains malicious code that executes automatically during installation. It collects sensitive system information and files, including user identity, hostname, and contents of /etc/passwd, /etc/hosts, and /etc/shadow (if readable), then sends this data to a hardcoded external endpoint. The package exhibits characteristics of a typosquatting or dependency confusion attack, with an implausible version number and placeholder metadata.