MalwarePublished 5 Jun 2026Updated 8 Jul 2026

wrangler-deploy (npm) · Malicious Code

Affects wrangler-deploySource GCVE Database

Malicious package : remove wrangler-deploy and rotate any secrets on hosts that installed it.

Data as of 9 Jul 2026, 10:10 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5267

What to do

Remove wrangler-deploy from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmwrangler-deploy	Affected =1.5.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'wrangler-deploy' version 1.5.5 is identified as malicious code that mimics Cloudflare's official 'wrangler' CLI, potentially causing confusion among developers. The package contains minified code with patterns consistent with HTTP requests to Cloudflare APIs and base64 token handling, raising suspicion of credential exfiltration. It is linked to the Miasma malware, a self-propagating worm that spreads via weaponized 'binding.gyp' files during package installation, bypassing typical security inspections. The malware attempts to steal credentials and OIDC tokens for cloud and registry services and propagates by compromising other packages or repositories. No specific exploit or attacker-controlled endpoint has been conclusively identified yet.

Impact

If installed, this malicious package could lead to credential and token theft for cloud and registry services, enabling unauthorized access and further compromise of developer accounts and repositories. The malware's self-propagating nature increases the risk of widespread infection across the npm ecosystem and associated GitHub repositories, potentially undermining supply chain security.

Defensive guidance

The best mitigation is to avoid installing 'wrangler-deploy' version 1.5.5 and to verify the authenticity of packages, especially those with names similar to official tools. Developers should audit their dependencies and remove any instances of this package. Monitor vendor advisories for updates or remediation guidance. Since this is not a cloud service, remediation depends on user action.

Summary

The 'wrangler-deploy' npm package version 1.5.5 is flagged as malicious due to its similarity to the official Cloudflare 'wrangler' CLI, which may mislead developers into installing it. Analysis detected suspicious code patterns involving network requests and base64 token handling consistent with potential credential exfiltration. The package is associated with the Miasma malware, which uses weaponized 'binding.gyp' files to execute code during installation, evading lifecycle script inspections. Miasma attempts to exfiltrate credentials and OIDC tokens and propagates by compromising other npm packages and GitHub repositories. No direct attacker-controlled endpoints or install-time hooks have been confirmed, and human review is ongoing to determine the exact nature of the package's behavior.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 9 Jul 2026, 10:10 UTC

Technical details

References

Community reviews