MalwarePublished 18 Apr 2026Updated 29 Jun 2026

@ataslkit/profilecard (npm) · Malicious Code

Affects @ataslkit/profilecardSource GCVE Database

Malicious package : remove @ataslkit/profilecard and rotate any secrets on hosts that installed it.

Data as of 29 Jun 2026, 22:21 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-2856

What to do

Remove @ataslkit/profilecard from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@ataslkit/profilecard	Affected =99.9.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @ataslkit/profilecard version 99.9.1 contains malicious code that communicates with a domain linked to malicious activity. Installing or running this package can lead to a full compromise of the affected computer. Removal of the package alone may not eliminate all malicious software introduced. Immediate rotation of all secrets and keys stored on the compromised system is strongly advised.

Impact

Any system with @ataslkit/profilecard version 99.9.1 installed or running is at risk of full compromise. Attackers may have gained control over the system, potentially accessing sensitive information, secrets, and keys. This can lead to unauthorized access, data theft, or further malicious activity originating from the compromised host.

Defensive guidance

Remove the @ataslkit/profilecard package version 99.9.1 immediately. Consider the affected system fully compromised and perform a thorough incident response. Rotate all secrets and keys stored on the compromised system from a separate, secure environment.

Summary

The npm package @ataslkit/profilecard version 99.9.1 has been identified as malicious by multiple sources including Amazon Inspector, GHSA malware reports, and the OpenSSF Package Analysis project. The package contains code that communicates with a domain associated with malicious activity, indicating potential backdoor or data exfiltration behavior. Systems with this package installed should be considered fully compromised, as the malicious code may have granted external entities control over the system. Due to the nature of the compromise, simply removing the package may not fully remediate the infection.

References

github.com/advisories/GHSA-3m34-94wv-xw5q (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Jun 2026, 22:21 UTC

Technical details

References

Community reviews