Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in cdp-core (npm)

The npm package cdp-core contained malicious code (cdp_inject.js) designed to harvest system information and credentials, then exfiltrate them over HTTPS to a hardcoded remote server. The package provided no legitimate functionality and was identified by OpenSSF's malicious-packages project.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or system that installed the malicious cdp-core package
Ecosystems
Attack vectors
Affected entities
  • cdp-corenpm package containing malicious code

The npm package cdp-core was found to contain malicious code in a file named cdp_inject.js. The malicious code imports Node.js modules for process execution (child_process), filesystem access (fs), and network communication (http/https), combined with base64 encoding capabilities.

Upon installation, the package automatically executes code that gathers sensitive system information including environment variables (process.env.USER), performs host reconnaissance via shell utilities like ping, and reads local files using fs.readFileSync. The collected data is base64-encoded and exfiltrated via HTTPS POST requests to a hardcoded remote hostname.

The package name and complete absence of any legitimate library functionality indicate the sole purpose of cdp-core was credential and data theft. The malicious behavior executes automatically on package load, affecting any developer or system that installed it.

The incident was identified and credited to the OpenSSF's malicious-packages project (GitHub advisory GHSA-xc49-p4pq-83rq).

Indicators of compromise

Packages
  • cdp-core

Remediation

  • Immediately uninstall cdp-core from all systems and projects
  • Audit npm package.json and lock files for any presence of cdp-core
  • Assume compromise of any system that installed cdp-core; rotate credentials and environment variables that may have been exposed
  • Review system logs and network traffic from affected systems for signs of data exfiltration
  • Use npm audit to check for other malicious packages
  • Implement package verification and allowlisting policies to prevent installation of suspicious packages

Sources

  1. GitHub Advisory GHSA-xc49-p4pq-83rq · GitHub Advisory Database

Cite this entry

"Malicious code in cdp-core (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-cdp-core-npm-isws30

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. activecritical

    Malware in @vaultflow/update-flow

    Malware was discovered in the npm package @vaultflow/update-flow. Systems with this package installed or running are considered fully compromised, with potential for complete system takeover.

    npmCompromised package
  2. activecritical

    Malware in @vaultflow/create-flow

    Malware discovered in the npm package @vaultflow/create-flow. Systems with this package installed are considered fully compromised and require immediate remediation.

    npmCompromised package
  3. resolvedcritical

    Malicious code in prettier-lint-lenz (npm)

    The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.

    npmCompromised packageTyposquatting
  4. activecritical

    Malware in @wrenfield/viem

    The npm package @wrenfield/viem contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised.

    npmCompromised package