Which versions of cvmbxcjiasdg are malicious?

The following npm versions of cvmbxcjiasdg are flagged malicious: 1.0.0, 1.0.1. Treat any of these as compromised.

How do I remediate cvmbxcjiasdg if I installed it?

cvmbxcjiasdg is a typosquat — you almost certainly intended a legitimately-named package. Remove cvmbxcjiasdg, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed cvmbxcjiasdg — how do I know if it already compromised me?

If cvmbxcjiasdg was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is cvmbxcjiasdg part of a known attack campaign?

Yes — cvmbxcjiasdg is associated with the GHSA-cvfr-666p-q22g, IN-MAL-2026-017490, IN-MAL-2026-017481 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find cvmbxcjiasdg across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for cvmbxcjiasdg (2 malicious versions).

Malicious package

cvmbxcjiasdgnpm

Advisory published Aug 12, 2026Updated Aug 12, 2026

cvmbxcjiasdg is a confirmed malicious npm package (MAL-2026-13799) that typosquats a legitimate package to trick installs (malicious versions 1.0.0, 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in cvmbxcjiasdg (npm)

MAL-2026-13799

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall cvmbxcjiasdg

What this malware does

The package contains a single index.html file declared as main and no JavaScript entry point, lifecycle scripts (preinstall/install/postinstall/prepare), or library exports. The HTML mimics a Cloudflare 'Just a moment...' Turnstile challenge and embeds obfuscator.io-style JavaScript with a custom base64 string array. When the fake challenge completes, decoded strings are used to construct a URL via new URL(...), the current page's query parameters are forwarded via URLSearchParams(window.location.search).forEach(...targetUrl.searchParams.append...), and the browser is navigated with window.location.replace(targetUrl.toString()). The redirect only executes in a browser that renders index.html; npm install and require() of this package run no code and touch no installer resources. The artifact appears to be an abuse of the npm registry as a static host for a phishing/redirect lure rather than an attack on developers installing the package.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

2 flagged

1.0.01.0.1

Indicators of compromise (SHA-256)

e19fa62b42fed4ea0f175e4fa4838fefd1072ffef406b9342de3e187b9529ebf

925628ce795fdbf222c292ae4ccfbe710eda2fa1b6fd521db3379f9569e16f9b

f11854867830a09107a4e2b5aca31d2fbb111c823683e77a37f598d52507ec93

Detection & response playbook

Typosquat

Find it
Search your lockfiles and build artifacts for cvmbxcjiasdg (2 malicious versions).
If you installed it — respond
cvmbxcjiasdg is a typosquat — you almost certainly intended a legitimately-named package. Remove cvmbxcjiasdg, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If cvmbxcjiasdg was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. cvmbxcjiasdg on npm has been identified as a malicious package (versions 1.0.0, 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

GHSA-cvfr-666p-q22gIN-MAL-2026-017490IN-MAL-2026-017481

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks cvmbxcjiasdg-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database