Malicious code in cdp-core (npm)
The npm package cdp-core contained malicious code (cdp_inject.js) designed to harvest system information and credentials, then exfiltrate them over HTTPS to a hardcoded remote server. The package provided no legitimate functionality and was identified by OpenSSF's malicious-packages project.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious cdp-core package
- Ecosystems
- Attack vectors
- Affected entities
- cdp-corenpm package containing malicious code
The npm package cdp-core was found to contain malicious code in a file named cdp_inject.js. The malicious code imports Node.js modules for process execution (child_process), filesystem access (fs), and network communication (http/https), combined with base64 encoding capabilities.
Upon installation, the package automatically executes code that gathers sensitive system information including environment variables (process.env.USER), performs host reconnaissance via shell utilities like ping, and reads local files using fs.readFileSync. The collected data is base64-encoded and exfiltrated via HTTPS POST requests to a hardcoded remote hostname.
The package name and complete absence of any legitimate library functionality indicate the sole purpose of cdp-core was credential and data theft. The malicious behavior executes automatically on package load, affecting any developer or system that installed it.
The incident was identified and credited to the OpenSSF's malicious-packages project (GitHub advisory GHSA-xc49-p4pq-83rq).
Indicators of compromise
- Packages
- cdp-core
Remediation
- Immediately uninstall cdp-core from all systems and projects
- Audit npm package.json and lock files for any presence of cdp-core
- Assume compromise of any system that installed cdp-core; rotate credentials and environment variables that may have been exposed
- Review system logs and network traffic from affected systems for signs of data exfiltration
- Use npm audit to check for other malicious packages
- Implement package verification and allowlisting policies to prevent installation of suspicious packages
Sources
- GitHub Advisory GHSA-xc49-p4pq-83rq · GitHub Advisory Database
Cite this entry
"Malicious code in cdp-core (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-cdp-core-npm-isws30
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @vaultflow/update-flow
Malware was discovered in the npm package @vaultflow/update-flow. Systems with this package installed or running are considered fully compromised, with potential for complete system takeover.
npmCompromised package - activecritical
Malware in @vaultflow/create-flow
Malware discovered in the npm package @vaultflow/create-flow. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting - activecritical
Malware in @wrenfield/viem
The npm package @wrenfield/viem contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package