MAL-2026-18199: Malicious code in @pkgship/frps-linux-amd64 can compromise computers
Summary
MAL-2026-18199: Installation or execution can give an outside entity control of the computer, exposing stored secrets and keys and potentially leaving additional malicious software behind. Affects @pkgship/frps-linux-amd64 versions 0.71.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
@pkgship/frps-linux-amd64 is an npm package in the JavaScript ecosystem. The supplied advisory identifies it as containing malicious code. The available record does not describe the package’s intended functionality or where it is used, so those details are not published.
Vulnerability Detail
The package can fully compromise a computer when installed or running, potentially giving an outside entity control. The vulnerability class is embedded malicious code (CWE-506). The advisory warns that removing the package may not remove other malicious software resulting from installation. It identifies version 0.71.1 as malicious; affected version ranges beyond that version are not published.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @pkgship/frps-linux-amd64If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Documented workaround: Remove @pkgship/frps-linux-amd64 and rotate all secrets and keys stored on the affected computer immediately, using a different computer. Treat the affected computer as fully compromised; removal alone may not eliminate additional malicious software.
Conclusion
No fixed version is published for @pkgship/frps-linux-amd64. Remove it, rotate stored secrets and keys from a different computer, and treat any system where it ran as fully compromised because removal may not eliminate additional malicious software. Vulert monitors the dependencies in package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for @pkgship/frps-linux-amd64 →
FAQ
@pkgship/frps-linux-amd64 version 0.71.1 is identified as malicious; other affected versions are not published.
@pkgship/frps-linux-amd64 can give an outside entity control of the computer and expose stored secrets and keys.
No fixed version is published for @pkgship/frps-linux-amd64; remove the package and follow the documented response.
Treat the computer as compromised, rotate its stored secrets and keys from a different computer, and remove the package as soon as possible.
Check package-lock.json manually for @pkgship/frps-linux-amd64. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
