MalwarePublished 12 Aug 2026

vfgnhlkxchrd (npm) · Malicious Code

Affects vfgnhlkxchrdSource GCVE Database

Malicious package : remove vfgnhlkxchrd and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:38 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13840

What to do

Remove vfgnhlkxchrd from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmvfgnhlkxchrd	Affected =1.0.1 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package vfgnhlkxchrd versions 1.0.0 and 1.0.1 contains a malicious HTML file that mimics a Cloudflare challenge page and redirects browsers to a typosquatted phishing domain. This payload activates only when the HTML file is loaded in a browser via an npm CDN, not during typical npm install or require operations. The package is used as free hosting for phishing infrastructure rather than as a functional Node module. Any system with this package installed or running should be considered fully compromised, and all secrets and keys should be rotated immediately. Removal of the package does not guarantee full remediation due to potential further compromise.

Impact

Systems with the vfgnhlkxchrd package installed or running are considered fully compromised, potentially allowing attackers full control. All secrets and keys stored on such systems may be exposed and must be rotated immediately. The malicious payload redirects users to a phishing domain, facilitating credential theft or other phishing attacks. Because the package acts as a hosting vector for phishing infrastructure, it poses a significant risk to users who access the malicious HTML file via npm CDNs. Removal of the package does not guarantee elimination of all malicious components due to possible further compromise.

Defensive guidance

Immediate removal of the vfgnhlkxchrd package versions 1.0.0 and 1.0.1 is recommended. All secrets, keys, and credentials stored on affected systems should be rotated immediately from a separate, trusted machine. Due to the high likelihood of full system compromise, a thorough security assessment and potential system rebuild may be necessary. Users should avoid loading the package's HTML file in browsers, especially via npm CDNs. Monitor for any suspicious activity related to this package and related domains.

Summary

The npm package vfgnhlkxchrd versions 1.0.0 and 1.0.1 includes a single HTML file as its main entry point, which contains obfuscated JavaScript that reconstructs and redirects to the URL https://config.microsofte.live/, a typosquatted domain mimicking Microsoft services. The malicious redirect triggers only when the HTML file is loaded in a browser environment, such as through npm CDNs like unpkg or jsdelivr, not during standard Node.js package installation or usage. This package is leveraged as a phishing hosting mechanism rather than a legitimate Node module. According to the GHSA malware advisory, any computer with this package installed or running is considered fully compromised, necessitating immediate rotation of all secrets and keys from a separate, trusted system. The advisory warns that removing the package alone may not remove all malicious software resulting from its installation.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:38 UTC

Technical details

References

Community reviews