MalwarePublished 18 Oct 2025Updated 31 Oct 2025

src_index_ts (npm) · Malicious Code

Affects src_index_tsSource GCVE Database

Malicious package : remove src_index_ts and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 23:22 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-48509

What to do

Remove src_index_ts from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsrc_index_ts	Affected >=8.0.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'src_index_ts' version 8.0.5 and later communicates with a domain linked to malicious activity. Installation or execution of this package can lead to full compromise of the affected computer, risking exposure of all stored secrets and keys. Immediate removal of the package and rotation of all credentials from a separate, secure device is strongly recommended.

Impact

Systems with 'src_index_ts' package version 8.0.5 or later installed are at risk of full compromise. Attackers may have obtained complete control over the affected computer, including access to all stored secrets and keys. This represents a severe security breach with potential for extensive data loss and unauthorized access.

Defensive guidance

Remove the 'src_index_ts' package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, secure device to prevent unauthorized access. Due to the potential for full system compromise, consider rebuilding or thoroughly cleaning affected systems to ensure removal of all malicious components.

Summary

The 'src_index_ts' npm package (versions >=8.0.5) has been identified as malicious due to its communication with a domain associated with harmful activity. According to source details, any system with this package installed or running should be considered fully compromised. This implies that attackers may have gained full control over the system, potentially accessing all secrets and keys stored on it. Removal of the package is advised, but it may not fully eliminate the malicious presence due to the extent of compromise.

References

github.com/advisories/GHSA-q455-gp34-p84h (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 23:22 UTC

Technical details

References

Community reviews