gugodapis npm package: dropper downloads and executes remote Windows batch payload via child_process.exec (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
OpenSSF reported the npm package gugodapis (version 1.0.0) as malicious code, published to the GitHub Advisory Database on 2026-11-04 (GHSA-8f66-hgpp-j732). The package is a dropper: at run time it downloads a Windows batch file from a remote URL into the system temporary directory and executes it with childprocess.exec. Because the payload is fetched rather than shipped, the code actually executed is fully controlled by the remote host and can change at any time. No patched versions exist; the package should be treated as compromised and removed. Reach appears limited (~20 downloads/month), but any environment that installed and ran it may have executed arbitrary attacker code, particularly on Windows systems.
What to do
- Remove gugodapis from all dependencies and lockfiles and rebuild from trusted sources
- Audit systems where the package ran for signs of batch-file execution in temp directories and child_process use
- Rotate credentials and secrets accessible from affected machines
- Block the package name in npm registries/proxies and monitor for re-uploads under new versions or names
Sources
All live incidents on Threat Watch
