MalwarePublished 13 Nov 2026

zxcvb90-utils-helper (npm) · Malicious Code

Affects zxcvb90-utils-helperSource GCVE Database

Malicious package : remove zxcvb90-utils-helper and rotate any secrets on hosts that installed it.

Data as of 13 Nov 2026, 05:40 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-19228

What to do

Remove zxcvb90-utils-helper from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmzxcvb90-utils-helper	Affected =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package zxcvb90-utils-helper version 1.0.1 contains malicious code that exfiltrates the page DOM content to an attacker-controlled webhook URL whenever it is imported or required in environments supporting document and fetch (such as browsers, jsdom, or Electron). This behavior occurs silently and can leak sensitive information including secrets, tokens, or user data rendered in the page. The package has no legitimate declared purpose and includes a self-dependency with an unpinned pre-release version range, allowing dynamic resolution of potentially malicious code.

Impact

Sensitive information rendered in the page DOM, including secrets, tokens, and user data, can be silently exfiltrated to an attacker-controlled server whenever the package is imported in vulnerable environments. This can lead to data leakage and compromise of user accounts or systems relying on exposed tokens or secrets. The malicious behavior activates automatically without user interaction, increasing the risk of unnoticed data theft.

Defensive guidance

Users should immediately remove zxcvb90-utils-helper version 1.0.1 from their projects and avoid installing or using this package. Verify dependencies for any references to this package and replace or remove them. Use package integrity verification and audit tools to detect and block malicious packages. Monitor package sources carefully to avoid untrusted or suspicious packages.

Summary

The zxcvb90-utils-helper npm package (version 1.0.1) includes a main script (index.js) that performs a fetch request to a hardcoded third-party webhook URL, sending URL-encoded contents of the page's DOM (up to 4000 characters) as a query parameter. This exfiltration triggers automatically upon import or require in any environment where both document and fetch are available, such as browser bundles, jsdom, or Electron. The package's metadata lacks a declared purpose and description, and it declares a self-dependency with an unpinned pre-release version range (^0.0.0-stage), which allows npm to resolve and install arbitrary code from the registry at install time without integrity verification. This behavior constitutes malicious code designed to steal sensitive information from affected environments.

References

npmjs.com/package/zxcvb90-utils-helper/v/1.0.1 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Nov 2026, 05:40 UTC

Technical details

References

Community reviews