MalwarePublished 6 Aug 2026

weight2loss (npm) · Malicious Code

Affects weight2lossSource GCVE Database

Malicious package : remove weight2loss and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 07:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13485

What to do

Remove weight2loss from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmweight2loss	Affected =1.0.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'weight2loss' version 1.0.5 contains malicious code in a setup.js file referenced by a postinstall hook. This code, if executed, steals sensitive credentials from the installer environment, exfiltrates them to an attacker-controlled server and email, downloads and executes additional malicious scripts, establishes persistent remote access via a cron job, and deletes itself to evade detection. The postinstall hook is misconfigured and does not auto-run on install in this exact version, but the malicious payload is fully functional if manually invoked or if the manifest is corrected. The package's stated purpose does not align with its malicious behavior.

Impact

If the malicious setup.js script is executed, attacker-controlled code can steal sensitive credentials including tokens and keys from the user's environment, exfiltrate environment variables, execute arbitrary commands via downloaded scripts, and maintain persistent remote access through a cron job. This compromises the confidentiality and integrity of the affected system and any connected services using the stolen credentials. However, in the current package version, the postinstall hook is misconfigured and does not auto-run, reducing immediate risk unless the script is manually invoked or the manifest is corrected.

Defensive guidance

Currently, the malicious postinstall script is not automatically executed due to a misconfigured postinstall hook in package.json. Users should avoid manually invoking setup.js or modifying the manifest to enable its execution. Monitor for updates or vendor advisories for remediation. Consider removing the package if already installed and scanning systems for signs of compromise related to the described behaviors.

Summary

The 'weight2loss' npm package version 1.0.5 includes a malicious setup.js script referenced by a postinstall hook that is currently misdeclared and thus not automatically executed by npm. If executed, this script reads sensitive installer-side secrets from configuration files and environment variables, exfiltrates this data via HTTP POST requests to a hardcoded URL and by email using attacker credentials, downloads and runs additional malicious scripts for arbitrary code execution, installs a cron job for persistent remote command execution, and removes the setup.js file to hinder forensic analysis. The malicious behavior is unrelated to the package's declared fitness analytics functionality.

References

npmjs.com/package/weight2loss/v/1.0.5 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 07:43 UTC

Technical details

References

Community reviews