Supply-chain attacksConfirmed malwareAutomated alert
pxnpm (npm): malicious versions published to a widely used package
MAL-2026-17710 confirms malicious code in pxnpm 7.0.0, 7.0.0-beta.6, 7.0.0-beta.8 and 2 more. The package had 165 clean releases before it.
- Package
- pxnpm (npm)
- Malicious versions
- 7.0.0, 7.0.0-beta.6, 7.0.0-beta.8, 7.0.1, 7.0.2
- First malicious version published
- 6 Oct 2026, 06:53 UTC
- Malware record published
- 9 Oct 2026, 13:32 UTC
- Confirmed by
- Amazon Inspector
- Package history
- since 4 Apr 2019, 165 clean releases before the malicious one
- Usage
- 10,123 weekly downloads
What to do
- Find it. Search every lockfile and build image, including transitive dependencies.
# Is it installed, and at which version? Malicious: 7.0.0 7.0.0-beta.6 7.0.0-beta.8 7.0.1 7.0.2 npm ls pxnpm --all grep -n '"node_modules/pxnpm"' -A2 package-lock.json grep -n 'pxnpm@' pnpm-lock.yaml yarn.lock 2>/dev/null - Remove it. Pin pxnpm to a version published before 6 Oct 2026 and reinstall from a clean lockfile.
- Rotate. Install-time malware usually steals environment variables, cloud keys, npm, PyPI and GitHub tokens, SSH keys and browser data. Revoke and reissue whatever the machine could reach.
- Hunt. Search proxy, DNS and EDR logs for the indicators below from the first malicious publish time onwards.
Indicators
Domains
- registry-pxnpm.rdc.nfjbill.ren
IP addresses
- 111.163.188.182
URLs
- https://registry-pxnpm.rdc.nfjbill.ren:20021/
- https://registry-pxnpm.rdc.nfjbill.ren:20021/__static/srv/downloads/pxnpm
- https://registry-pxnpm.rdc.nfjbill.ren:20022/
Indicators exactly as the records list them. Block or hunt for them; do not visit them.
Records and references
- MAL-2026-17710 (OSV)
- https://osv.dev/vulnerability/MAL-2026-13605 (advisory)
- https://www.npmjs.com/package/pxnpm/v/7.0.0 (package)
- https://www.npmjs.com/package/pxnpm/v/7.0.1 (package)
- https://www.npmjs.com/package/pxnpm/v/7.0.2 (package)
- https://www.npmjs.com/package/pxnpm/v/7.0.0-beta.6 (package)
- https://www.npmjs.com/package/pxnpm (registry page)
About this alert
This page was generated automatically by VEDAS from confirmed public malware records (the OpenSSF malicious-packages database, via OSV) and the package registry. It has not yet been reviewed by an analyst. Package names, versions, times and indicators are copied from those records; the advice above is the same for every confirmed malicious release. How packages are classified is explained on the supply-chain page.