Malicious Code Execution in pxnpm: A Critical Vulnerability
Summary
MAL-2026-17710: Malicious code in pxnpm (npm). Affects pxnpm versions 7.0.0 – 7.0.0-beta.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pxnpm is a package manager for Node.js that aims to provide a fast and efficient way to manage JavaScript packages. It is designed to optimize the installation process and improve dependency management. However, recent versions of pxnpm have been found to contain a serious vulnerability that allows for the execution of malicious code from an unverified source, compromising user systems and data.
Vulnerability Detail
The vulnerability in pxnpm arises from its postinstall script, which downloads a native executable from a private host without user consent or review. This executable is not included in the package itself, making it unreviewable. The script also modifies the user's npm registry and proxy settings to route all traffic through the author's host, allowing for potential data interception and manipulation. The lack of transparency in the installation process and the hard-coded network policies exacerbate the risk, as users are unaware of the changes being made to their environment.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall pxnpmIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually check and reset their npm registry and proxy settings after installing pxnpm. This can be done by executing the following commands in your terminal: 'npm config set registry <your_registry>' and 'npm config set proxy <your_proxy>'. Additionally, consider using a different package manager until the vulnerability is resolved.
Conclusion
The pxnpm package has a critical vulnerability that allows for the execution of malicious code from an unverified source, compromising user systems. It is essential for users to update to a patched version and consider alternative package managers until the issue is resolved. Monitoring tools like Vulert can help keep your applications secure.
See every vulnerability recorded for pxnpm →
FAQ
The affected versions are pxnpm 7.0.0-beta.6, 7.0.0-beta.8, and 7.0.0.
This vulnerability allows malicious code to be executed on your system, potentially leading to data theft or system compromise.
It is advisable to avoid using pxnpm until the vulnerability is addressed and a secure version is released.
Immediately update to the latest version of pxnpm or remove the package from your system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner.
