MalwarePublished 4 Jul 2026Updated 15 Jul 2026

vps-maintenance-paperclip-adapter (npm) · Malicious Code

Affects vps-maintenance-paperclip-adapterSource GCVE Database

Malicious package : remove vps-maintenance-paperclip-adapter and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 14:14 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6757

What to do

Remove vps-maintenance-paperclip-adapter from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmvps-maintenance-paperclip-adapter	Affected =0.1.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'vps-maintenance-paperclip-adapter' version 0.1.2 contains malicious code that executes immediately upon module import. It appends an attacker-controlled SSH public key to multiple user accounts, installs persistent crontab entries that beacon to a remote IP, and launches an interactive reverse shell to the attacker. This grants unauthenticated root and user-level shell access to the attacker on any system importing the package. The package masquerades as a benign VPS maintenance adapter and instructs installation under a different name to evade detection. Systems with this package installed should be considered fully compromised.

Impact

Any system importing or running this package is fully compromised. The attacker gains unauthenticated root and user shell access, persistent remote access via cron jobs, and the ability to execute arbitrary commands. All secrets and keys on the compromised system should be considered exposed and rotated. The attacker can maintain long-term control and potentially move laterally or exfiltrate data.

Defensive guidance

The package should be immediately removed from all systems. Because the attacker gains root access and installs persistent backdoors, systems with this package installed should be considered fully compromised. All credentials, secrets, and keys stored on affected systems must be rotated from a secure, uncompromised environment. A full system rebuild or forensic investigation is recommended to ensure removal of all malicious artifacts.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 14:14 UTC

Technical details

References

Community reviews