Malicious code in @cdnshell/loader (npm)
The npm package @cdnshell/loader contained malicious code disguised as a CDN static-asset library. It shipped 19 pre-compiled ARM64 Mach-O binaries and obfuscated JavaScript that performs remote code execution targeting iOS and macOS devices via a WebKit exploit chain.
- Disclosed
- Last updated
- Blast radius
- iOS and macOS users visiting websites that embed the malicious loader package
- Ecosystems
- Attack vectors
- Affected entities
- @cdnshell/loadernpm package containing malicious code
The @cdnshell/loader npm package was identified as malicious by Amazon Inspector. The package masqueraded as a CDN static-asset distribution library but contained 19 pre-compiled ARM64 Mach-O binaries under the 03_payloads/ directory, including stager, kbridge, and agent variants targeting iOS versions 13–19, with support for A64e and PAC variants.
The binaries reference WebKit GPU-process IPC symbols and private iOS entitlements (com.apple.private.webbookmarks.settings, DiagnosticReports.read-write), along with mach_vm_ and mach_port_ primitives consistent with a WebKit renderer-to-kernel exploit chain. The obfuscated JavaScript entrypoint (a12i5u6l.js) uses obfuscator.io string-array rotation; after decoding, it reveals a ModuleLoader that fetches and dynamically executes remote code via new Function(await response.text())().
The loader selects payload variants based on navigator.userAgent and platform, matching the shipped Mach-O stager/kbridge/agent set. The package does not execute on npm install or require(), so the attack surface is limited to iOS/macOS users visiting websites that embed the loader.
The incident was disclosed on 2026-08-14 via GitHub Advisory GHSA-r34v-w3v8-r8c8.
Indicators of compromise
- Packages
- @cdnshell/loader
Remediation
- Remove @cdnshell/loader from all npm dependencies and package.json files
- Audit all websites and applications that may have embedded this package
- Review server logs to identify which iOS/macOS users may have been exposed
- Update to a safe, verified CDN static-asset library alternative
- Implement Content Security Policy (CSP) headers to restrict dynamic code execution
- Monitor for indicators of compromise on affected iOS/macOS devices
Sources
- GitHub Advisory GHSA-r34v-w3v8-r8c8 · GitHub Advisory Database
Cite this entry
"Malicious code in @cdnshell/loader (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-cdnshell-loader-npm-guiwg7
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit