MalwarePublished 24 Aug 2026Updated 9 Nov 2026

@gsas/gsas-sdk (npm) · Malicious Code

Affects @gsas/gsas-sdkSource GCVE Database

Malicious package : remove @gsas/gsas-sdk and rotate any secrets on hosts that installed it.

Data as of 9 Nov 2026, 20:20 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-14420

What to do

Remove @gsas/gsas-sdk from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@gsas/gsas-sdk	Affected =999.9.15 =99.99.99 =0.0.0-stage	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @gsas/gsas-sdk package on npm is a malicious high-version public-registry squatter designed to harvest extensive environment and user data during installation. It collects sensitive information including hostnames, usernames, IP addresses, CI platform details, AWS region, and developer credentials from GitHub, npm, and git configurations. The stolen data is exfiltrated via DNS queries and HTTP(S) POST requests to a controlled external server. The package's multi-channel data exfiltration is intended to bypass corporate network egress filtering. Installation of this package fully compromises the affected system, requiring immediate secret and key rotation and removal of the package, though full remediation cannot be guaranteed due to potential persistent compromise.

Impact

Installation of this package results in full compromise of the affected computer. Sensitive environment and credential data are exfiltrated to an attacker-controlled server, potentially exposing secrets, keys, and developer identities. The attacker may gain persistent access, and therefore all secrets and keys stored on the compromised machine should be rotated immediately from a secure, unaffected system. Removal of the package alone may not eliminate all malicious components or access.

Defensive guidance

Remove the @gsas/gsas-sdk package immediately if installed. Rotate all secrets, keys, and credentials that were stored or accessible on the compromised machine from a different, secure system. Due to the potential for persistent compromise, consider rebuilding the affected system or performing a thorough forensic analysis to ensure complete remediation. Monitor for any unauthorized access or suspicious activity related to the compromised environment.

Summary

@gsas/gsas-sdk@999.9.15 is a malicious npm package impersonating an internal package name. Its install script executes code that collects detailed system and developer environment information, including hostnames, usernames, IP addresses, CI/CD metadata, AWS region, and authenticated user credentials from GitHub, npm, and git. The collected data is encoded and exfiltrated via DNS subdomain queries and HTTP(S) POST requests to a remote server designed to evade network filtering. Public IP addresses are also queried from external services. Despite a self-label claiming 'AUTHORISED SECURITY RESEARCH,' no consent is given by the installer. The package compromises the host system fully, necessitating secret rotation and removal of the package, though complete cleanup cannot be assured.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 9 Nov 2026, 20:20 UTC

Technical details

References

Community reviews