MalwarePublished 29 Oct 2025

sort-keys-plus (npm) · Malicious Code

Affects sort-keys-plusSource GCVE Database

Malicious package : remove sort-keys-plus and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 23:06 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-49044

What to do

Remove sort-keys-plus from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsort-keys-plus	Affected =9.9.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'sort-keys-plus' version 9.9.0 contains malicious code that installs a dependency from a custom domain which executes an information stealer during installation. This malware targets sensitive tokens related to npm, git, and CI/CD environments. Systems with this package installed are considered fully compromised, and all secrets and keys stored on those systems should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee eradication of the malicious software or attacker access.

Impact

Systems with 'sort-keys-plus' version 9.9.0 installed are fully compromised. The attacker gains access to sensitive tokens used for npm, git, and CI/CD pipelines, which can lead to further unauthorized access and control over development and deployment environments. The compromise risks exposure of secrets and credentials, potentially enabling broader supply chain attacks or unauthorized code changes.

Defensive guidance

Immediately remove the 'sort-keys-plus' package version 9.9.0 from all affected systems. Rotate all secrets, keys, and tokens that were stored or used on the compromised systems, performing this rotation from a separate, trusted machine. Because full system compromise is possible, conduct a thorough investigation and remediation of affected systems beyond package removal.

Summary

The 'sort-keys-plus' npm package version 9.9.0 is malicious. It installs a dependency hosted on a custom domain that runs an info stealer during installation. The info stealer specifically targets npm, git, and other CI/CD tokens, potentially exposing sensitive credentials and access tokens. Due to the nature of the compromise, any system with this package installed should be treated as fully compromised, requiring secret rotation and comprehensive remediation beyond simple package removal.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 23:06 UTC

Technical details

References

Community reviews