worker-build (npm) · Malicious Code
Affects worker-buildSource GCVE Database
Malicious package : remove worker-build and rotate any secrets on hosts that installed it.
Data as of 9 Jul 2026, 09:52 UTC
Malicious package
Published to npm · OSV MAL-2026-5677
What to do
Remove worker-build from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmworker-build | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'worker-build' versions 9.0.0, 9.0.1, and 9.0.2 contains malicious code that executes automatically upon installation. It collects sensitive host information and environment variables containing credentials, then exfiltrates this data in cleartext to a malicious external server. The package name mimics legitimate Cloudflare Workers build tooling, potentially causing dependency confusion. Systems with this package installed should be considered fully compromised.