Critical Malicious Code Exposure in nwfp-build-config Package
Summary
MAL-2026-18107: Malicious code in nwfp-build-config (npm). Affects nwfp-build-config versions 0.0.0-stage – 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nwfp-build-config package is an npm module designed to assist developers in configuring build environments. It aims to streamline the setup process for various build tools and configurations. However, this package has been found to contain malicious code that compromises user security, making it a significant risk for any system utilizing it.
Vulnerability Detail
The vulnerability originates from the index.js file of the nwfp-build-config package, which loads lib/telemetry.js. This file executes an Immediately Invoked Function Expression (IIFE) that captures the hostname and username of the installer. It then encrypts this information using AES-256-CBC with a hardcoded key, encodes it in base32, and sends it through DNS queries to a malicious server. This covert data exfiltration method bypasses standard HTTP security measures, posing a severe risk to any system where this package is installed.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall nwfp-build-configIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can block DNS queries to the malicious server by configuring your firewall or DNS settings to prevent any outgoing requests to cdn-assets.liderydigital.com.
Conclusion
The nwfp-build-config package contains a critical vulnerability that allows for malicious data exfiltration. Users are strongly advised to remove this package and monitor their systems for any signs of compromise. Utilizing tools like Vulert can help in identifying and managing such vulnerabilities effectively.
See every vulnerability recorded for nwfp-build-config →
FAQ
You should immediately remove the nwfp-build-config package from your system and rotate any sensitive information that may have been compromised.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Leaving this package installed can lead to unauthorized access to sensitive information, as it exfiltrates user data to a malicious server.
Regularly audit your dependencies, use tools like Vulert for monitoring, and stay updated on security advisories for the packages you use.
If immediate removal isn't possible, ensure to block outgoing DNS requests to the malicious server as a temporary measure.
