# GHSA-3rj7-hf4w-jh5c: Malicious code in radio-player-theme (npm)

> GHSA-3rj7-hf4w-jh5c is a critical-severity vulnerability, classed as Embedded Malicious Code (CWE-506), in radio-player-theme (npm). Affected versions: = 6.0.0. The package is malicious, so there is no safe version: remove it and rotate any credentials it could reach.

Canonical page: https://cveminer.com/vulnerabilities/GHSA-3rj7-hf4w-jh5c

| Field | Value |
| --- | --- |
| GHSA | GHSA-3rj7-hf4w-jh5c |
| Severity | Critical |
| CWE | CWE-506 Embedded Malicious Code |
| CISA KEV | Not listed |
| Published | 21 Sept 2026 |
| Modified | 21 Sept 2026 |

## Description

`radio-player-theme` presents itself as a radio player theme. The published tarball contains three files: `package.json`, `style.css` (declared as `main`) and `payload.js`, which holds the package's only executable code.

`payload.js` is a browser payload. On execution it reads `location.origin` and `document.cookie`, extracts the value of a `MANAGER-XSRF-TOKEN` cookie, and sends the origin together with the collected state to an out-of-band callback domain under `oastify.com` by assigning it to an `Image.src`. It then issues a second authenticated request to a third-party manager API and writes the collected data to `window.__radioXssProof`.

The file carries a comment describing itself as a bug bounty proof of concept for a CSP bypass through a public CDN that serves npm packages. Regardless of that claim, the published package delivers working data-collection code to anyone who loads it, and the package has no other function.

The package declares no install hooks, so `npm install` alone does not execute the payload; the code runs when the file is loaded in a browser, which is what CDN delivery of an npm package enables.

Evidence: `payload.js:7` holds the hardcoded callback domain; `payload.js:13-19` perform the cookie read and the beacons. Determination: manual review of the published tarball (sha256 `ddbb93aa9416c1c89cf15dc7627f4a816a1c31929238ed8608264546ba0df186`).

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/609451fc3f54f62c2d3ebbd72476a5ae5b67a56b/osv/malicious/npm/radio-player-theme/MAL-2026-16347.json))

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| radio-player-theme | npm | `pkg:npm/radio-player-theme` | = 6.0.0 | no fix |

## Questions

**Does GHSA-3rj7-hf4w-jh5c have a CVE ID?**

No CVE ID has been assigned to GHSA-3rj7-hf4w-jh5c yet. It is tracked only as a GitHub advisory.

**Which versions are affected by GHSA-3rj7-hf4w-jh5c?**

radio-player-theme (npm): = 6.0.0.

**How do I fix GHSA-3rj7-hf4w-jh5c?**

The package is malicious, so there is no safe version: remove it and rotate any credentials it could reach.

**What is the Package URL (PURL) for GHSA-3rj7-hf4w-jh5c?**

The affected package's PURL is pkg:npm/radio-player-theme.

## References

- https://github.com/advisories/GHSA-3rj7-hf4w-jh5c (advisory)
- https://github.com/ossf/malicious-packages/blob/609451fc3f54f62c2d3ebbd72476a5ae5b67a56b/osv/malicious/npm/radio-player-theme/MAL-2026-16347.json

---

Source: CVEminer (https://cveminer.com/vulnerabilities/GHSA-3rj7-hf4w-jh5c), compiled from GitHub Advisory Database. OSV and GitHub Advisory Database content is licensed CC BY 4.0.