MalwarePublished 13 Aug 2026

semaphore-job-pool (npm) · Malicious Code

Affects semaphore-job-poolSource GCVE Database

Malicious package : remove semaphore-job-pool and rotate any secrets on hosts that installed it.

Data as of 14 Aug 2026, 16:45 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-14010

What to do

Remove semaphore-job-pool from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsemaphore-job-pool	Affected =2.2.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'semaphore-job-pool' version 2.2.2 was found to contain malicious code or depend on a package with malicious code. Any system with this package installed or running should be considered fully compromised. Immediate removal of the package and rotation of all secrets and keys from a different, trusted system is strongly advised. However, removal of the package alone may not eliminate all malicious software introduced by it.

Impact

Systems with 'semaphore-job-pool' version 2.2.2 installed are considered fully compromised, risking exposure of all stored secrets and keys. Attackers may have gained full control over the affected computer, leading to potential data theft, unauthorized access, and persistent malicious activity.

Defensive guidance

Remove the 'semaphore-job-pool' package version 2.2.2 immediately from all affected systems. Rotate all secrets and keys stored on the compromised systems from a separate, trusted computer. Due to the potential for persistent malicious software beyond the package itself, consider conducting a full system investigation and remediation to ensure complete removal of malicious components.

Summary

The 'semaphore-job-pool' npm package version 2.2.2 contains malicious code or a dependency with malicious code, as identified by Amazon Inspector and the GitHub Security Advisory database. The presence of this package on a system implies a full compromise, potentially allowing attackers to gain control over the affected computer. The advisory recommends considering all secrets and keys stored on the compromised system as exposed and rotating them immediately from a secure environment. Due to the severity of the compromise, simply uninstalling the package may not fully remediate the infection.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 16:45 UTC

Technical details

References

Community reviews