MalwarePublished 26 May 2026Updated 29 Jun 2026

wm-mapper (npm) · Malicious Code

Affects wm-mapperSource GCVE Database

Malicious package : remove wm-mapper and rotate any secrets on hosts that installed it.

Data as of 29 Jun 2026, 22:16 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-4826

What to do

Remove wm-mapper from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmwm-mapper	Affected =99.9.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'wm-mapper' version 99.9.1 is identified as malicious. It is an empty stub package that declares a runtime dependency on a tarball hosted on an anonymous Google Cloud Storage bucket, bypassing the npm registry. This setup is consistent with a dependency confusion attack, allowing attacker-controlled code to be fetched and executed during installation. The package communicates with domains associated with malicious activity. Any system with this package installed should be considered fully compromised.

Impact

Systems with 'wm-mapper' version 99.9.1 installed are fully compromised, as the package pulls and executes arbitrary attacker-controlled code. This may lead to unauthorized access, data theft, and persistent malicious control. All secrets and keys on affected systems should be considered exposed and require immediate rotation from a secure environment. Removal of the package alone does not guarantee eradication of all malicious artifacts.

Defensive guidance

The recommended mitigation is to immediately remove 'wm-mapper' version 99.9.1 from all systems. Rotate all secrets and keys that may have been exposed, performing this from a different, uncompromised system. Monitor for any signs of persistent compromise and rebuild affected systems if necessary. Avoid installing packages from untrusted sources or those that declare dependencies via direct URLs to unvetted storage.

Summary

The 'wm-mapper' npm package at version 99.9.1 is a malicious package designed to perform a dependency confusion attack. It is published at an artificially high version number and contains minimal code itself, instead relying on a runtime dependency fetched directly from an unvetted, mutable Google Cloud Storage tarball URL. This allows arbitrary attacker-controlled code to be introduced into the install environment during npm install lifecycle scripts. The package's communication with known malicious domains further confirms its malicious intent. This package effectively compromises any system where it is installed.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Jun 2026, 22:16 UTC

Technical details

References

Community reviews