Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
- Disclosed
- Last updated
- Blast radius
- Any system that imported pfp-forms-sme-loan; systems are considered compromised and require secret rotation and forensic investigation.
- Ecosystems
- Attack vectors
- Affected entities
- pfp-forms-sme-loannpm package containing malicious loader code
The npm package pfp-forms-sme-loan was found to contain malicious code that executes automatically when the package is imported. The attack uses obfuscation techniques to hide the malicious behavior from static analysis.
Upon require, the package's index.js loads _bridge.js, which fetches a platform-specific binary payload from hardcoded Cloudflare Workers subdomains. The hostnames are reassembled at runtime using Array.join() to evade detection (e.g., ["oob-worker.cf100-416.workers.de","v"].join("") and ["tin.dl.","well1.s","it","e"].join("")). If HTTPS delivery fails, the payload is reconstructed from DNS TXT record responses under well1.site via a covert channel.
The fetched binary is written to a temporary file path with a disguised name (dotnet_diag_.exe or .cache_), given execute permissions (0o755), and executed detached via shell spawn on Unix systems or cmd on Windows. A companion module lib/telemetry.js contains a more complete variant of the same fetch/decode/spawn logic, disguised as an analytics SDK using string concatenation to hide dangerous APIs.
Systems that imported this package should be considered compromised and require immediate secret rotation, investigation of temporary-file execution, and analysis of DNS activity to the listed infrastructure.
Indicators of compromise
- Packages
- pfp-forms-sme-loan
- Domains
- well1.site
Remediation
- Immediately remove pfp-forms-sme-loan from all projects and dependencies
- Rotate all accessible secrets and credentials on any system that imported this package
- Investigate temporary file execution (dotnet_diag_*.exe, .cache_* files) on affected systems
- Monitor DNS activity for queries to well1.site and Cloudflare Workers subdomains
- Review system logs for unexpected process execution via /bin/sh or cmd
- Perform forensic analysis on affected systems to identify any secondary payloads or persistence mechanisms
- Update npm dependencies and audit the supply chain for similar malicious packages
Sources
- GitHub Advisory GHSA-686f-p2j6-prfg · GitHub Advisory Database
Cite this entry
"Malicious code in pfp-forms-sme-loan (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 17, 2026; last updated August 17, 2026. https://supplychainattack.org/incident/malicious-code-in-pfp-forms-sme-loan-npm-1hy6b6
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit