jsDelivr virus: why cdn.jsdelivr.net shows up in malware alerts, and what to do if you ran a pasted command

What jsDelivr is, and why a security tool may call it a virus

jsDelivr is not a virus. It is a free public content delivery network that copies files from npm packages and GitHub repositories and serves them fast from servers around the world. Millions of websites load scripts and fonts from cdn.jsdelivr.net every day. Because anyone can publish a file to GitHub, and jsDelivr will serve that file, criminals sometimes use it as a free and trusted looking place to keep their malware. The service is safe; some of the files it passes along are not.

In September 2026 the abuse.ch project URLhaus listed five such file addresses on cdn.jsdelivr.net. Four were scripts tied to ClickFix tricks, where a fake check on a web page tells you to paste a command, and three of them were tagged ACRStealer, a password stealer for Windows.

The fifth was an installer for Nezha, a server monitoring tool that attackers also use for remote access. All five were offline when we read the data on 8 October 2026.

1. 1

   What URLhaus lists

   Five file addresses on cdn.jsdelivr.net, all under the /gh/ path, which means each file was copied from a GitHub repository. They were added on 12, 13, 15, 17 and 28 September 2026. Every entry has the threat label malware_download and the status offline. Three were reported by abuse_ch, one by n3x77 and one by drewfink.

2. 2

   What the tags mean

   ClickFix is a trick where a web page asks you to copy and paste a command to fix an error or prove you are human. TerminalFix is a newer form of it that sends you to Windows Terminal or PowerShell. ACRStealer is a stealer sold to criminals. powershell and ps1 say the file is a PowerShell script. redis and sh say the last file is a Linux shell script used against Redis database servers.

3. 3

   What we could not confirm

   We did not download the files, so we cannot show what is inside them. URLhaus tags are reports, not a full analysis. We also do not know which web pages showed the lures or how many people pasted the commands.

4. 4

   What this means for you

   If your browser, antivirus or firewall only named cdn.jsdelivr.net, nothing is proven: almost every visit to that address is a normal website loading a normal script. The risk is for a person who pasted a command from a web page into the Run box, Terminal or PowerShell, and for the owner of a Linux server that ran an installer it should not have.

Kind of threat

Malware delivered through a legitimate CDN: ClickFix scripts tagged ACRStealer, one TerminalFix file and one Nezha agent installer

The service

jsDelivr, a free open source CDN for npm and GitHub files. The domain jsdelivr.net was registered on 16 May 2012 through Amazon Registrar, Inc. (RDAP, read 8 October 2026)

Where the files were

hxxps://cdn.jsdelivr[.]net/gh/<GitHub account>/<repository>@<version>/<file>, five different GitHub accounts

URLhaus entries

5 file addresses, added between 12 and 28 September 2026; all 5 offline on 8 October 2026

Delivery trick

ClickFix and TerminalFix: a page tells you to paste a command; the command fetches the script from jsDelivr

Platform

Windows for the ClickFix and ACR Stealer files. Linux servers for the Nezha installer. Nothing we read says iPhone or Android

What we checked on 8 October 2026, and what we could not

We sent one plain request from our server to https://cdn.jsdelivr.net/ on 8 October 2026, with no browser and no clicks. It answered with a redirect (HTTP 301) to https://www.jsdelivr.com, the project's home page, through Cloudflare. That is what a healthy CDN does with its bare address. It does not test the five reported files, and a quiet answer clears nothing.

The five reports, in order

The reports cover just over two weeks. Dates and tags come from the URLhaus data in our job record; the times are UTC.

1. 16 May 2012

   jsdelivr.net is registered

   RDAP shows the domain registered on 16 May 2012 through Amazon Registrar, Inc. The service has run for over fourteen years.

2. 12 September 2026

   First ACR Stealer script

   At about 07:25 UTC abuse_ch adds a file under a GitHub account whose name is a string of digits and hyphens. Tags: ACRStealer, ascii, ClickFix, powershell, ps1.

3. 13 September 2026

   A second one, same pattern

   At about 12:57 UTC another file is added from a different account with a name made of hex like groups. Same five tags.

4. 15 September 2026

   A third one

   At about 07:01 UTC a third file is added, from an account named with digits only. Tags: ACRStealer, ascii, powershell, ps1.

5. 17 September 2026

   A file named llm, tagged TerminalFix

   At about 15:44 UTC n3x77 reports a file called llm in a repository named futures-import, pinned to commit 04e2419. Tags: ClickFix and TerminalFix.

   

6. 28 September 2026

   A Nezha agent installer

   At about 06:11 UTC drewfink reports agent/install.sh from a repository called scripts under the account nezhahq, on the main branch. Tags: redis and sh.

7. 8 October 2026

   All offline, and our check

   All five entries are marked offline. Our plain request to the CDN's bare address gets a normal redirect to the project home page.

Our reading of the pattern: the three ACR Stealer files come from throwaway looking accounts with random names, which fits a campaign that makes new GitHub accounts as old ones are removed. That is an inference from the names, not something a report states.

How criminals use jsDelivr, and why it works for them

jsDelivr does not check what a GitHub file does before it serves it, in the same way a post office does not open every letter. That is by design: the service exists to deliver open source code fast. Criminals take advantage of the trust that security tools and people give to a well known address.

1. 1

   Any GitHub file gets a jsDelivr address

   jsDelivr's own documentation gives the pattern /gh/user/repo@version/file, where the version can be a release, a commit or a branch. Anyone who puts a file in a public GitHub repository can therefore link to it through cdn.jsdelivr.net, with no sign up at jsDelivr.

2. 2

   The address looks trusted

   Check Point wrote on 20 July 2023 that attackers can use the CDN to avoid security tools that treat web downloads as suspicious, because many legitimate packages are loaded from jsDelivr. A firewall cannot block the whole domain without breaking a large part of the web.

3. 3

   Files can outlive their source

   In the same report Check Point found files from an npm package that npm had marked malicious about a month earlier still reachable through jsDelivr, and another case more than a year old. Pinning a link to a fixed commit, like the @04e2419 in one of our entries, keeps a file reachable as long as that copy exists.

4. 4

   The CDN removes content for security reasons

   jsDelivr's documentation says content may be restricted for serious security or legal reasons backed by clear evidence, and asks for such reports to go privately to legal@jsdelivr.com with the affected URLs. It does not remove files only because they were deleted upstream.

What ACR Stealer is

Three of the five files were tagged ACRStealer. Microsoft's Defender Experts reported a surge of ACR Stealer attacks on business customers from late April to mid June 2026, in a post of 16 July 2026.

The TerminalFix file and the Nezha installer

Two of the five reports are not ACR Stealer. They show two other ways the same CDN shows up in attacks.

1. 1

   TerminalFix: the command goes into Windows Terminal

   Microsoft described TerminalFix on 28 August 2026, as reported by BleepingComputer on 31 August. Fake Cloudflare checks on hacked websites copy a PowerShell command and tell the visitor to run it in Windows Terminal. The chain Microsoft described hides code in PNG pictures, sets a scheduled task and a Run key, and opens a tunnel into the victim's network. We do not know what the file named llm on jsDelivr did.

2. 2

   Nezha: a real tool used as a back door

   Nezha is an open source monitoring tool for servers with a remote shell. Darktrace wrote on 10 June 2026 that attackers install a modified Nezha installer as root on Linux servers to keep remote access, and found 141 infected servers on one attacker panel. Huntress, as reported, saw the same tool used on Windows to add Defender exclusions.

3. 3

   Why a real project's installer can be reported

   The reported path, nezhahq/scripts@main/agent/install.sh, has the Nezha project's own name. Our reading: the file may be the genuine installer, and the report concerns how attackers used it against exposed Redis servers (the redis tag), not the file being changed. URLhaus does not say which.

What a stealer from these chains can take

The list below is what the sources say ACR Stealer takes. It applies only to a Windows PC where a pasted command really ran.

What this can cost you

Seeing cdn.jsdelivr.net in a log costs nothing. The risks below are for a PC where a pasted command ran, or a server where an installer ran that nobody chose.

• High

  Accounts opened without a password

  Stolen session tokens can keep working after you change the password. Microsoft's advice is to revoke sessions and tokens, not only to reset passwords.

• High

  Work files and cloud folders

  OneDrive and SharePoint files synced to the PC can be copied, so a home infection can become an employer's data leak.

• High

  A network opened from inside

  In the TerminalFix chain the goal was a tunnel into the internal network, which Microsoft says can lead to stolen credentials or ransomware.

• Medium

  A server used by someone else

  A Nezha agent installed by an attacker gives remote command access to a Linux server.

• Low

  Nothing, if you only saw the name

  A blocked request or a log line with cdn.jsdelivr.net is not an infection. Most such requests are normal websites.

How to tell a bad jsDelivr link from a normal one

Look at what is after the domain and at how the link reached you. The domain alone tells you nothing either way.

The single rule that covers all four ClickFix files: no real website, CAPTCHA or error message needs you to paste a command into Windows. Microsoft's ClickFix analysis of 21 August 2025 says the trick relies on people not knowing what the Run dialog is for.

Check your PC before you delete anything

The question that matters: did you paste and run a command that a web page gave you? If not, and you only saw the address in a log, you can stop here. If yes, or you are not sure, do these checks. None of them deletes anything.

Use another device for banking, email and work until you finish.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the cable. A stealer needs the connection to send what it takes.

2. 2

   Look at Protection history

   Open Windows Security > Virus & threat protection > Protection history. Write down any detection from the day you ran the command.

3. 3

   Look at the Run box history

   Commands typed in the Run box are remembered. Press Windows key and R and open the drop down list. A long line with powershell, mshta or a jsdelivr address is the trace of the lure.

4. 4

   Open Task Scheduler

   Press Start, type Task Scheduler, open Task Scheduler Library and look for a task with an update like name that runs PowerShell, Python or a script from a user folder. Microsoft says ACR Stealer hides as such a task. Note it; do not delete yet.

5. 5

   Check Startup apps and odd processes

   Open Settings > Apps > Startup and Task Manager. A pythonw.exe, mshta.exe or a hidden PowerShell running with no reason is worth a note.

If you run a Linux server and the Nezha report concerns you

The Nezha entry was tagged redis and sh. That points to servers, not home PCs. The Windows steps on this page do not apply to a Linux server.

1. 1

   Look for an agent you did not install

   Check running services and processes for a Nezha agent, and check cron for jobs that pipe a downloaded script into a shell. Darktrace's case used a cron job named ngk.

2. 2

   Close the door it came through

   A Redis server must not be reachable from the internet without a password. Restrict it to localhost or a private network.

3. 3

   Rebuild if root ran it

   A script that ran as root can change anything. Rebuild the server from a known good image and rotate every key and password stored on it.

If you use a Mac, an iPhone or an Android phone

The four ClickFix reports and the sources describe Windows. jsDelivr is just as reachable from any device, but nothing we read says these files run on a phone or a Mac.