Malicious code in node-array-plus (npm)
node-array-plus, an npm package with no legitimate functionality, contained heavily obfuscated malicious code that downloads, decrypts, and executes remote code on installation. The package was identified and reported by OpenSSF's malicious-packages project.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed node-array-plus via npm
- Ecosystems
- Attack vectors
- Affected entities
- node-array-plusnpm package with malicious code
node-array-plus is an npm package that contained obfuscated malicious code designed to execute remote code on the installer's machine. The package exposes no legitimate API surface and has an empty description, indicating it was created solely for malicious purposes.\n\nUpon require(), the module uses a 312-entry rotated string array combined with RC4 and base64 decoders to conceal its true functionality. It constructs a hardcoded IPv4 endpoint by concatenating numeric octets, performs an HTTP GET request to that endpoint, and decrypts the response using AES-256-CBC encryption with an MD5-derived key and IV extracted from the response.\n\nThe decrypted payload is written to a file under the user's home directory and executed via child_process with windowsHide:true and cwd set to the home directory. The obfuscation was specifically employed to hide the destination endpoint and the decrypt-drop-exec execution chain.\n\nThe malicious package was identified and credited to the OpenSSF's malicious-packages project.
Indicators of compromise
- Packages
- node-array-plus
Remediation
- Immediately uninstall node-array-plus from all systems
- Audit npm package.json and lock files for any presence of node-array-plus
- Review system logs and process execution history on machines where node-array-plus was installed for signs of unauthorized code execution
- Check home directories on affected systems for suspicious files created during installation
- Regenerate any credentials or sensitive data that may have been exposed on affected systems
- Use npm audit to identify and remove any other malicious or compromised dependencies
Sources
- GitHub Advisory GHSA-mgw3-3jfq-3gwx · GitHub Advisory Database
Cite this entry
"Malicious code in node-array-plus (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-node-array-plus-npm-n75pf4
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
npmCompromised package