MAL-2026-18608: Malicious code in gugodapis (npm)
Dropper. At run time the package downloads a Windows batch file from a remote URL into the system temporary directory and executes it with childprocess.exec. The payload is fetched, not shipped, so the code that runs is controlled by the remote host. Version examined: 1.0.0; tarball SHA-256 ea725cf1c5c950a7a8f091a717cfd2a76e7dd7b81000afe37b7398c76f3c4e3a.
Affected Software
Event History
Frequently Asked Questions
Which systems are most directly exposed?
Windows systems where gugodapis version 1.0.0 is installed and its runtime code executes are directly exposed. The package downloads and runs a Windows batch file from a remote host.
What conditions are required for code execution?
The package must run and be able to fetch the remote payload. The remote host controls the fetched code, so the executed payload can change without a change to the installed package.
How can I check whether the examined package version is present?
Check for gugodapis version 1.0.0 and compare the package tarball SHA-256 to ea725cf1c5c950a7a8f091a717cfd2a76e7dd7b81000afe37b7398c76f3c4e3a. Runtime activity may also involve a batch file written to the system temporary directory and launched through child_process.exec.
What should be done if the package cannot be replaced immediately?
Prevent the package's runtime code from executing on affected Windows systems. No fixed version or alternative remediation is provided in the available data.