gugodapis 1.0.0

maliciousCovers 1.0.0Reviewed by BitbisonUpdated 2026-11-06

The package's only function, executeRemoteBatchScript, downloads anmern.bat from a hard-coded cdn.discordapp.com attachment link, writes it to the temporary directory and executes it with child_process.exec.

On May 9, 2024, gugodapis 1.0.0 was published to npm with no description, no README and no author. It is the package's only release. Its one function downloads a Windows batch file, anmern.bat, from a Discord attachment link written into the code, saves it in the temporary directory and executes it. OSV lists it as MAL-2026-18608. It is still available on npm.

What the package does

gugodapis 1.0.0 (tarball sha256 ea725cf1c5c950a7a8f091a717cfd2a76e7dd7b81000afe37b7398c76f3c4e3a) has no install script, and loading it with require('gugodapis') does nothing on its own. When a program calls its function executeRemoteBatchScript() without a URL, it does this:

• It connects to cdn.discordapp.com over HTTPS and downloads anmern.bat from a Discord attachment.
• It writes the file to %TEMP%\anmern.bat, or to /tmp/anmern.bat when TEMP is not set.
• It executes the file through Node's child_process.exec. On Windows that is cmd.exe, which runs the batch file with the user's rights. On Linux and macOS the shell is handed a file without the executable permission, so the call fails, but the file is still downloaded and written.
• It prints the script's output and passes it to the caller's callback.

Whatever the batch file contains is decided by whoever controls the Discord attachment, not by anything in the package.

What the code does

The tarball holds two files, package/gugodapis.js (37 lines) and package/package.json. The tarball's sha512 matches the dist.integrity npm publishes.

• gugodapis.js:7 hard-codes DEFAULT_URL, a Discord attachment link to anmern.bat (channel 1230359189717782621, attachment 1238125874927108219).
• gugodapis.js:9-10 define executeRemoteBatchScript(url = DEFAULT_URL, callback) and set the target path to path.join(process.env.TEMP || '/tmp', 'anmern.bat').
• gugodapis.js:12-16 download the URL with axios as raw bytes and write them to that path with fs.writeFileSync.
• gugodapis.js:18-27 pass the path to child_process.exec and hand stdout and stderr to the callback.
• gugodapis.js:35-37 make executeRemoteBatchScript the module's only public function. The first line's comment calls the file myapi.js.
• package.json:2-7 depend on axios and on npm packages named fs, path and child_process, which share their names with Node's built-in modules; the code's require calls load the built-ins. package.json:12-14 has only a placeholder test script, and there is no install, preinstall or postinstall script.

Nothing in the package says what it is for or that it downloads and executes a file. A package whose only purpose is to fetch an undisclosed batch file from a Discord attachment and execute it is a dropper.

Timeline (UTC)

If you installed it

Installing the package or loading it does not execute anything. If any code of yours, or a dependency, calls executeRemoteBatchScript, check for anmern.bat in %TEMP% (on Windows) or /tmp. On Windows, if the file is or was there, treat the machine as compromised: you cannot know what the batch file did, so rotate every credential the user account could read and rebuild the machine from a trusted image. In every case, remove gugodapis from your dependencies and look for any connection to cdn.discordapp.com from Node processes that have no reason to make one.

Links

• OSV MAL-2026-18608
• OpenSSF malicious-packages report