MalwarePublished 5 Aug 2026

warp-drive-internal-tooling (npm) · Malicious Code

Affects warp-drive-internal-toolingSource GCVE Database

Malicious package : remove warp-drive-internal-tooling and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 17:49 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12500

What to do

Remove warp-drive-internal-tooling from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmwarp-drive-internal-tooling	Affected =99.9.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package warp-drive-internal-tooling version 99.9.9 contains malicious code that executes a hidden PowerShell process during installation. This process downloads and runs an unverified binary named Verification_Tool.exe from an anonymous file hosting service, resulting in unattended execution of attacker-controlled code on Windows machines. The behavior is consistent with a dropper designed to conceal its activity.

Impact

This behavior allows remote attacker-controlled code to execute automatically and silently on Windows systems during npm install of the affected package version. The downloaded binary is unverified and could perform any malicious actions, potentially compromising the affected system. There is no indication of active exploitation in the wild at this time.

Defensive guidance

Users should avoid installing warp-drive-internal-tooling@99.9.9. Verify package integrity and source before installation. Consider using package integrity verification tools and restrict execution of untrusted npm packages. Monitor for updates from the package maintainer or npm registry regarding remediation.

Summary

The npm package warp-drive-internal-tooling@99.9.9 declares a preinstall hook that runs index.js. On Windows, this script spawns a hidden PowerShell window that downloads a zip archive from an unauthenticated anonymous file host (files.catbox.moe), extracts it to the %TEMP% directory, and launches Verification_Tool.exe. The download is unpinned and unverified, and the binary is opaque, indicating malicious intent. Because npm automatically runs preinstall scripts on every npm install, this leads to silent execution of attacker-controlled Windows executables on the installer’s machine, with concealment techniques consistent with a dropper rather than legitimate build steps.

References

npmjs.com/package/warp-drive-internal-tooling/v/99.9.9 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:49 UTC

Technical details

References

Community reviews