MAL-2026-18445

    Dashboard / Malicious Package / MAL-2026-18445

    MAL-2026-18445

    Published: 29 Oct 2026Last Modified: 2 Nov 2026

    Summary: Malicious code in self-v8 (npm)

    Details: Malicious package. `self-v8` is an npm package that harvests sensitive data on the victim host and exfiltrates it to an attacker-controlled Discord webhook. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.

    References: https://www.npmjs.com/package/self-v8, https://wormsign.io/portfolio/self-v8/

    Affected packages

    Package

    Name: self-v8

    Purl: pkg:npm/self-v8

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.0.0