VULNpocalypse
HighSupply chainActive

pxnpm npm package turned into a native-binary launcher that reroutes your registry through the author’s host

pxnpm 7.0.0 to 7.0.2 on npm ship a postinstall launcher that downloads and runs a native binary and forces your registry and proxy through the author’s host.

Published
Updated
Fixed in
No clean 7.x release; remove pxnpm and pin a known-good version published before 6 October 2026
Exploitation
Yes. The malicious versions were live on npm and ran their native-binary launcher on install; the final payload returned a registry document at analysis time and could not be examined

What happened

pxnpm is an established npm package, published since April 2019 with 165 clean releases and about 10,123 weekly downloads, so it was widely enough used to count as a hijack rather than a throwaway malicious upload (OSV MAL-2026-17710). On 6 October 2026 the account nfjbill published versions 7.0.0-beta.6, 7.0.0-beta.8 and 7.0.0, and later 7.0.1 and 7.0.2 with the same behaviour; the OSSF malicious-packages record was imported on 9 October (OSV MAL-2026-17710), (OSSF malicious-packages PR 1619). Reports describe the versions as published by that account, and do not confirm whether this was an account takeover or the maintainer acting (OSSF malicious-packages PR 1619).

What the code does. The 7.x releases are a small launcher, about ten files, for a native executable that is not shipped inside the package (OSV MAL-2026-17710):

  • Install-time download. The postinstall script bin/install.cjs calls ensureNative() in dist/download.cjs, which downloads a 17 to 21 MB Brotli archive for the current platform from a non-npm host and decompresses it into a 52 to 72 MB executable under ~/.cache/pxnpm/native/ (OSV MAL-2026-17710).
  • Execution. dist/launcher.cjs runs that executable with child_process.spawn, both on install and on every later run (OSV MAL-2026-17710).
  • Registry and proxy takeover. The launcher deletes the user’s existing npm, pnpm and proxy settings and forces the registry and proxy to the author’s own host, and it rejects any --registry or --proxy flags. The proxy URL, with embedded credentials, is hidden as a base64 string (OSV MAL-2026-17710).
  • Self-pinned verification. The archive and executable are checked only against hashes shipped in the same package, and a manifest sets a fixed network policy that ignores any user-supplied download location, so the package trusts only the attacker’s source (OSV MAL-2026-17710).

What it steals is not confirmed. At analysis time the download endpoint returned a registry JSON document instead of the archive, so the native payload could not be examined and its behaviour is unknown; the JavaScript itself reportedly collects no data (OSV MAL-2026-17710). The clear, confirmed harm is that every package resolution and tarball download made through pxnpm is routed through a host the author controls, which can observe or alter the dependencies you install (OSV MAL-2026-17710). The same author’s package yakuza0 2.23.40 hard-codes the same host, under the related record MAL-2026-13605 (OSV MAL-2026-17710). The malicious content was removed from npm after the report (OSV MAL-2026-17710).

Indicators of compromise (OSV MAL-2026-17710):

  • Host: registry-pxnpm.rdc.nfjbill.ren, IP 111.163.188.182, ports 20021 (download) and 20022 (proxy).
  • dist/download.cjs SHA-256 581a8a00162307841ad3b71395afa9401e0c0003a5a585337aba3758246661b7.
  • dist/launcher.cjs SHA-256 85209f280b5a9031a9cac69ead044a636df8b4b5606cbe94cb60dad6df1d2618.
  • dist/native-manifest.json SHA-256 c9cee327ad6187e45e0b7c03c593dae16a346afe96b373a933931e918787a9fd.

The record was reported by Amazon Inspector and researcher Eunsoo Kim, and imported from the OSSF malicious-packages database (OSV MAL-2026-17710).

Am I affected?

  • You are affected if any developer machine, CI runner or container image installed pxnpm at 7.0.0-beta.6, 7.0.0-beta.8, 7.0.0, 7.0.1 or 7.0.2. The postinstall step runs on install, so merely installing it was enough to fetch and run the binary (OSV MAL-2026-17710).
  • Check your lockfiles and caches, not just direct dependencies: a transitive pull or a cached copy still triggers it.
  • Earlier releases are not implicated. The malicious behaviour is in the 7.x line from 7.0.0-beta.6 onward (OSV MAL-2026-17710).

What to do now

  1. Find it. Search lockfiles and installed trees for pxnpm at any 7.x version (npm ls pxnpm, grep package-lock.json and pnpm-lock.yaml), across developer machines, CI and images.
  2. Remove it and the binary. Uninstall pxnpm and delete ~/.cache/pxnpm/native/ on every affected host (OSV MAL-2026-17710).
  3. Restore your package settings. The launcher rewrites npm, pnpm and proxy configuration to the author’s host; inspect .npmrc, pnpm config and environment proxy variables and reset the registry and proxy to your own (OSV MAL-2026-17710).
  4. Treat affected hosts as compromised. A native binary of unknown behaviour ran on them, so rotate any credentials, tokens and SSH keys that were present, and review for persistence (OSSF malicious-packages PR 1619).
  5. Hunt the indicators. Block and search logs for registry-pxnpm.rdc.nfjbill.ren and 111.163.188.182, and flag any npm or pnpm traffic that did not go to your expected registry.
  6. Pin a known-good version. There is no clean 7.x release; if you need pxnpm, pin a version published before 6 October 2026, and consider whether you need it at all given the same author’s yakuza0 package behaves the same way (OSV MAL-2026-17710).
  7. Harden installs. Run CI with install scripts disabled (npm install --ignore-scripts) where you can, so a postinstall payload cannot run unattended.

Sources