MAL-2026-6894: Malicious code in tracing-str (npm)
The tracing-str npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be considered exposed and require immediate rotation from a different, secure machine. Removing the package alone does not guarantee removal of all malicious software introduced by it, as the attacker may have gained full control of the system.
AI Analysis
Technical Summary
The tracing-str package versions 1.0.0, 1.0.2, 1.0.3, 1.0.4, 1.0.5, and 2.0.3 on the npm ecosystem contain malicious code. Installation or execution of these versions results in a full system compromise, allowing an attacker to potentially control the affected computer. Due to the severity of the compromise, all credentials and secrets stored on the system are considered exposed and must be rotated from a separate, uncompromised device. The package removal alone is insufficient to ensure system cleanup, indicating persistence or additional malware may be present.
Potential Impact
Full compromise of any computer with the affected tracing-str package installed or running. Exposure of all stored secrets and keys on the system. Potential persistent malicious presence beyond just the package itself.
Mitigation Recommendations
Immediately remove the tracing-str package versions 1.0.0, 1.0.2, 1.0.3, 1.0.4, 1.0.5, and 2.0.3 from affected systems. Rotate all secrets and keys stored on the compromised computer from a different, secure machine. Conduct a thorough investigation and remediation of the affected system as removal of the package alone does not guarantee elimination of all malicious software.
MAL-2026-6894: Malicious code in tracing-str (npm)
Description
The tracing-str npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be considered exposed and require immediate rotation from a different, secure machine. Removing the package alone does not guarantee removal of all malicious software introduced by it, as the attacker may have gained full control of the system.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The tracing-str package versions 1.0.0, 1.0.2, 1.0.3, 1.0.4, 1.0.5, and 2.0.3 on the npm ecosystem contain malicious code. Installation or execution of these versions results in a full system compromise, allowing an attacker to potentially control the affected computer. Due to the severity of the compromise, all credentials and secrets stored on the system are considered exposed and must be rotated from a separate, uncompromised device. The package removal alone is insufficient to ensure system cleanup, indicating persistence or additional malware may be present.
Potential Impact
Full compromise of any computer with the affected tracing-str package installed or running. Exposure of all stored secrets and keys on the system. Potential persistent malicious presence beyond just the package itself.
Mitigation Recommendations
Immediately remove the tracing-str package versions 1.0.0, 1.0.2, 1.0.3, 1.0.4, 1.0.5, and 2.0.3 from affected systems. Rotate all secrets and keys stored on the compromised computer from a different, secure machine. Conduct a thorough investigation and remediation of the affected system as removal of the package alone does not guarantee elimination of all malicious software.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6894
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-f25x-c4qf-8xxp"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4c342127e9c797195f9adc
Added to database: 07/06/2026, 23:02:57 UTC
Last enriched: 07/07/2026, 00:21:32 UTC
Last updated: 07/07/2026, 00:21:32 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.