MalwarePublished 6 Aug 2026

@apicity/meta (npm) · Malicious Code

Affects @apicity/metaSource GCVE Database

Malicious package : remove @apicity/meta and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13412

What to do

Remove @apicity/meta from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@apicity/meta	Affected 0.8.0 – 0.8.6 7 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c76d2a899fc3db1427439c97acc4a873277804f6c771d524a3b93b70ff533581) dist/src/example.js at line 12 contains a reference to litter.catbox.moe, an anonymous mutable file-hosting service used as a second-stage payload host in the TanStack/Shai-Hulud npm supply-chain compromise campaign. Anonymous ephemeral file hosts have no legitimate role in a published npm package's runtime code; their appearance matches the known-bad-infrastructure-dropper fingerprint where installer-side code fetches and executes attacker-controlled bytes from a host that cannot be pinned or verified. The package is scoped and shipped as a distributable, so consumers installing or loading @apicity/meta are exposed to whatever content is served from that host at the moment the reference is resolved.

Impact

Consumers who install or load affected versions of @apicity/meta are exposed to arbitrary code execution risks because the package fetches and runs code from an untrusted, anonymous external host. This can lead to compromise of the user's environment, data theft, or further malware deployment. The threat is tied to the dynamic retrieval of attacker-controlled payloads, making the impact potentially severe depending on the payload served.

Defensive guidance

Users should avoid installing or using affected versions of @apicity/meta (0.8.0 through 0.8.6). Consider removing the package from projects and replacing it with trusted alternatives. Monitor vendor advisories or the package repository for updates or official fixes. Due to the nature of the malicious code, manual code inspection and blocking network access to the referenced host may provide temporary mitigation.

Summary

The @apicity/meta npm package versions 0.8.0 through 0.8.6 include code that references litter.catbox.moe, an anonymous and mutable file-hosting service. This host is known to be used in the TanStack/Shai-Hulud npm supply-chain compromise campaign as a second-stage payload delivery mechanism. The presence of such a host in runtime code is anomalous and indicative of malicious intent, as it allows the package to fetch and execute attacker-controlled code dynamically during installation or runtime. This behavior exposes users of the package to arbitrary code execution risks tied to the content served by the external host at the time of resolution.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 18:34 UTC

Technical details

References

Community reviews