MalwarePublished 28 Oct 2025Updated 3 Nov 2025

geopost-web-component (npm) · Malicious Code

Affects geopost-web-componentSource GCVE Database

Malicious package : remove geopost-web-component and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 23:41 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-48947

What to do

Remove geopost-web-component from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmgeopost-web-component	Affected =17.8.0 =18.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'geopost-web-component' versions 17.8.0 and 18.0.0 contain malicious code that executes commands associated with harmful behavior. Installation or use of this package can lead to full compromise of the affected computer, risking exposure of all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different, secure machine is strongly advised.

Impact

Systems with the 'geopost-web-component' package installed at versions 17.8.0 or 18.0.0 are at risk of full compromise. Attackers may gain complete control over the affected computer, leading to potential theft or misuse of sensitive information such as secrets and keys. The presence of this package indicates a high likelihood of malicious activity on the system.

Defensive guidance

Remove the 'geopost-web-component' package versions 17.8.0 and 18.0.0 immediately from all affected systems. Rotate all secrets and keys stored on those systems from a different, secure machine to prevent unauthorized access. Because full compromise is possible, consider rebuilding affected systems to ensure removal of all malicious components.

Summary

The 'geopost-web-component' npm package at versions 17.8.0 and 18.0.0 has been identified as malicious by multiple sources including Amazon Inspector, GHSA Malware, and the OpenSSF Package Analysis project. The package executes commands linked to malicious activity, potentially granting attackers full control over the host system. Due to this, any system with this package installed should be considered fully compromised. Removal of the package alone may not eliminate all malicious artifacts, and all secrets and keys stored on the system should be rotated immediately from a secure environment.

References

github.com/advisories/GHSA-62jv-q5c7-gr9m (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 23:41 UTC

Technical details

References

Community reviews