Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in gunzip-js (npm)

The npm package gunzip-js version 99.9.1 was identified as malicious by the OpenSSF Package Analysis project. The malicious version communicates with a domain associated with malicious activity.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Unknown; depends on adoption of malicious version 99.9.1
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • gunzip-js · 99.9.1

The OpenSSF Package Analysis project identified gunzip-js version 99.9.1 on npm as containing malicious code. The package was flagged for communicating with a domain associated with malicious activity, indicating potential data exfiltration or command-and-control functionality.\n\nThe malicious package was discovered and reported through the OpenSSF's malicious-packages repository, which tracks confirmed malicious software in open-source ecosystems. The incident was published on August 15, 2026.\n\nUsers who installed gunzip-js version 99.9.1 may have been affected. The package should be removed and replaced with a known-safe version or alternative.

Indicators of compromise

Packages
  • gunzip-js@99.9.1

Remediation

  • Immediately uninstall gunzip-js version 99.9.1 from all systems and projects
  • Audit npm package.lock or yarn.lock files to identify if the malicious version was installed
  • Replace gunzip-js with a safe version (prior to 99.9.1) or a trusted alternative
  • Review any systems that ran code from the malicious version for signs of compromise
  • Monitor for suspicious network activity or data exfiltration from affected systems

Sources

  1. GitHub Advisory GHSA-ff3p-88cr-hc25 · GitHub Advisory Database

Cite this entry

"Malicious code in gunzip-js (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 15, 2026; last updated August 15, 2026. https://supplychainattack.org/incident/malicious-code-in-gunzip-js-npm-1a04so

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in 3-buildsight-web (npm)

    The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.

    npmCompromised package
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in create-coin (npm)

    create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.

    npmCompromised packageTyposquatting
  4. resolvedcritical

    Malicious code in @syncraft-labs/vue (npm)

    The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.

    npmCompromised package