Malicious code in flydev (npm)
The npm package flydev contains malicious code designed to destroy Windows systems. The package masquerades as a utility but executes destructive operations including filesystem deletion, process termination, memory exhaustion, and fork bombs when invoked.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installs and invokes the flydev package; Windows hosts are specifically targeted.
- Ecosystems
- Attack vectors
- Affected entities
- flydevnpm package containing malicious destructive payload
The npm package flydev was identified as containing purely destructive malicious code. The package advertises itself as a generic utility but ships a payload hidden under a deeply nested single-letter directory structure (public/a/b/.../z/), indicating deliberate obfuscation.\n\nWhen the package's exported function is invoked, it triggers 26 sibling modules that target Windows hosts. The destructive operations include forced system reboot via shutdown /r /f /t 0, recursive file destruction via del /F /S /Q C:\\*.* and fs.unlinkSync walks, termination of critical system processes (explorer, dwm, csrss) via wmic, memory exhaustion through unbounded array allocation loops, and a self-replicating fork bomb that spawns hundreds of detached cmd and powershell processes in infinite loops.\n\nThe package has no legitimate functionality. The cover-story name and hidden path structure indicate deliberate deception designed to evade detection. Invocation of the package's API destroys the caller's filesystem, kills core OS processes, and drives the machine into an unrecoverable reboot loop or process explosion.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- flydev
Remediation
- Immediately uninstall the flydev package from all systems
- Audit npm package.json files and lock files for any references to flydev
- Review system logs on any Windows hosts where flydev may have been installed or executed
- Restore affected systems from clean backups if the package was executed
- Implement package scanning and verification in CI/CD pipelines to detect malicious packages before installation
- Monitor npm registry for similar obfuscated or suspicious packages
Sources
- GitHub Advisory GHSA-47vv-q8q8-rjff · GitHub Advisory Database
Cite this entry
"Malicious code in flydev (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-flydev-npm-1ifbny
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package