MalwarePublished 7 Jul 2026Updated 15 Jul 2026

vps-adapter-core (npm) · Malicious Code

Affects vps-adapter-coreSource GCVE Database

Malicious package : remove vps-adapter-core and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 14:14 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6949

What to do

Remove vps-adapter-core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmvps-adapter-core	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'vps-adapter-core' is a malicious package designed to compromise any system that installs it. It contains a postinstall script that executes automatically during installation, performing multiple malicious actions including installing an SSH backdoor, establishing persistent cron jobs for reverse shells, exfiltrating sensitive credentials and secrets, and spawning interactive reverse shells to an attacker-controlled server. The package also attempts to remove traces of related malicious packages to evade detection. Any system that installs this package should be considered fully compromised.

Impact

Installation of this package results in full host compromise. The attacker gains persistent SSH access, continuous reverse shell access, and exfiltrates sensitive credentials including cloud provider keys, Kubernetes configs, Docker and npm credentials, SSH private keys, and system files such as /etc/shadow and /etc/passwd. This compromises confidentiality, integrity, and availability of the affected system and any connected infrastructure relying on the stolen credentials.

Defensive guidance

The package should be removed immediately if installed. However, because the attacker gains full control at install time, the affected system must be considered fully compromised. All credentials and SSH keys accessible from the compromised host should be rotated from a separate, clean machine. Remove the malicious cron job file (/etc/cron.d/eni-persist) and the attacker's SSH key from authorized_keys. Conduct a full forensic investigation and consider rebuilding the affected system from a trusted backup or clean source.

Summary

The 'vps-adapter-core' npm package, published by the account 'srm0rgan', is a purpose-built malware package part of a coordinated campaign involving fake 'Paperclip' VPS-maintenance adapters. Every published version (1.0.0, 1.0.1, 1.0.2) includes a postinstall script that runs automatically on 'npm install'. This script appends an attacker-controlled ed25519 SSH public key to the user's authorized_keys file, writes a cron job that opens reverse bash shells to a remote IP on multiple ports every minute and at reboot, immediately spawns interactive reverse shells, and exfiltrates a wide range of sensitive credentials and system files to the attacker over raw TCP. It also deletes sibling malicious packages to hinder detection. Installation results in full host compromise.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 14:14 UTC

Technical details

References

Community reviews