MalwarePublished 17 Apr 2026Updated 29 Jun 2026

eslint-plugin-totara (npm) · Malicious Code

Affects eslint-plugin-totaraSource GCVE Database

Malicious package : remove eslint-plugin-totara and rotate any secrets on hosts that installed it.

Data as of 29 Jun 2026, 22:19 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-2846

What to do

Remove eslint-plugin-totara from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmeslint-plugin-totara	Affected =99.9.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package eslint-plugin-totara version 99.9.1 contains malicious code that communicates with a domain linked to malicious activity. Installation or execution of this package may lead to full compromise of the affected system. Removal of the package alone may not eliminate all malicious components, and any secrets or keys stored on the compromised system should be rotated immediately from a different, clean device.

Impact

Systems with eslint-plugin-totara version 99.9.1 installed or running are at risk of full compromise. Attackers may have gained unauthorized access or control, potentially exposing all stored secrets and keys. The presence of malicious communication domains suggests data exfiltration or command and control activities. Simply removing the package does not guarantee eradication of all malicious artifacts.

Defensive guidance

Remove the eslint-plugin-totara package version 99.9.1 immediately from all affected systems. Consider all systems with this package installed as fully compromised. Rotate all secrets, keys, and credentials from a separate, uncompromised device. Conduct a thorough investigation and remediation of affected systems to ensure no residual malicious software remains. Monitor for any suspicious activity related to this compromise. Patch status is not applicable as this is a malicious package, not a vulnerability with a vendor fix.

Summary

The eslint-plugin-totara package at version 99.9.1 was identified as malicious by multiple sources including Amazon Inspector, GHSA malware reports, and the OpenSSF Package Analysis project. The package contains code that communicates with a domain associated with malicious activity, indicating it is designed to perform unauthorized or harmful actions. Systems with this package installed or running should be considered fully compromised, as the malicious code may have granted external control. The package is flagged as a supply chain threat in the npm ecosystem.

References

github.com/advisories/GHSA-gvr8-64fv-6p2h (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Jun 2026, 22:19 UTC

Technical details

References

Community reviews