MalwarePublished 25 Oct 2026Updated 10 Nov 2026

@factoryz/apollo (npm) · Malicious Code

Affects @factoryz/apolloSource GCVE Database

Malicious package : remove @factoryz/apollo and rotate any secrets on hosts that installed it.

Data as of 10 Nov 2026, 04:35 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18278

What to do

Remove @factoryz/apollo from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@factoryz/apollo	Affected =99.9.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @factoryz/apollo version 99.9.1 is a malicious package that acts as a lure. It contains only an empty stub but declares a dependency on an off-registry tarball fetched via a hardcoded HTTPS URL without integrity checks or version pinning. Installing this package causes arbitrary code execution from the fetched tarball, potentially compromising the host system. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately. Removal of the package alone does not guarantee elimination of all malicious software.

Impact

Installation of this package results in arbitrary code execution on the affected system due to unverified code fetched from an external URL. This can lead to full system compromise, including unauthorized access to secrets and keys stored on the machine. The compromise is severe enough that all credentials should be rotated from a separate, trusted system. Simply removing the package does not guarantee removal of all malicious artifacts.

Defensive guidance

Remove the @factoryz/apollo package version 99.9.1 immediately from all affected systems. Rotate all secrets and keys stored on compromised systems using a different, secure machine. Because the package executes arbitrary code from an external source without integrity checks, consider affected systems fully compromised and perform thorough incident response and remediation.

Summary

The @factoryz/apollo npm package (version 99.9.1) is a malicious package designed to execute arbitrary code by fetching a dependency tarball from a hardcoded off-registry URL without any integrity verification or publisher binding. The package itself contains only an empty stub, but its manifest specifies a dependency on 'ltidisafe' resolved from 'https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.7.tgz'. Installing this package downloads and executes lifecycle scripts from the tarball, allowing an attacker to run arbitrary code on the victim's system. The unusually high version number and lack of registry dependency resolution suggest a dependency confusion or resolution-winning attack vector. Systems with this package installed are considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Nov 2026, 04:35 UTC

Technical details

References

Community reviews