MalwarePublished 5 Aug 2026Updated 15 Aug 2026

@wololasod/tiny-id (npm) · Malicious Code

Affects @wololasod/tiny-idSource GCVE Database

Malicious package : remove @wololasod/tiny-id and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12331

What to do

Remove @wololasod/tiny-id from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@wololasod/tiny-id	Affected 0.1.0 – 0.1.3 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @wololasod/tiny-id, advertised as a tiny ID generator, contains malicious code in its main entry point. The code uses obfuscation and an RC4 string-array virtual machine to download and execute a remote payload specific to the platform (Windows or Linux). It runs the payload as a hidden, detached process that persists beyond the parent process. The package also improperly includes executable code in a TypeScript declaration file, which should only contain type definitions. This behavior is unrelated to the advertised functionality and indicates malicious intent.

Impact

Users who install and import the affected versions of @wololasod/tiny-id risk executing a hidden, persistent malicious payload downloaded from a remote server. This can lead to unauthorized code execution on the host system, potentially compromising system integrity and confidentiality. The malicious process is designed to evade detection by running detached and hidden, complicating incident response.

Defensive guidance

Users should immediately cease using the affected versions (=0.1.0, =0.1.1, =0.1.3) of @wololasod/tiny-id. Remove the package from any projects and replace it with a trusted alternative. Monitor for any processes matching the described behavior and investigate systems where this package was installed.

Summary

The @wololasod/tiny-id npm package versions 0.1.0, 0.1.1, and 0.1.3 contain an obfuscated loader that, upon import, determines the platform and downloads a remote executable to a temporary or APPDATA directory. It then executes this payload using child_process.spawn, employing a VBS launcher on Windows and direct spawn on Linux, followed by deletion of the staged file. The loader re-launches itself as a detached, hidden process that survives the parent process. The obfuscation includes RC4-decoded string arrays, hex-named identifiers, integrity checks on native code functions, and a caller-hash gate that crashes if the code is reformatted. Additionally, the malicious dropper is embedded in the dist/index.d.ts file, which is supposed to contain only TypeScript type declarations, not executable code. None of these actions relate to the package's stated purpose of generating tiny IDs.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:07 UTC

Technical details

References

Community reviews