MalwarePublished 18 Oct 2025Updated 31 Oct 2025

src_module_index_ts (npm) · Malicious Code

Affects src_module_index_tsSource GCVE Database

Malicious package : remove src_module_index_ts and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 23:22 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-48510

What to do

Remove src_module_index_ts from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsrc_module_index_ts	Affected >=8.2.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'src_module_index_ts' version 8.2.0 and later communicates with a domain linked to malicious activity. Installation or execution of this package results in a fully compromised system, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different, uncompromised machine is strongly advised.

Impact

Systems with the 'src_module_index_ts' package version 8.2.0 or later installed are considered fully compromised. This includes potential unauthorized access and control by an external attacker, leading to exposure and possible theft of all stored secrets and keys. The compromise may persist even after removal of the package, indicating a severe impact on system integrity and confidentiality.

Defensive guidance

Remove the 'src_module_index_ts' package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, secure computer. Due to the high likelihood of full system compromise, consider rebuilding affected systems to ensure complete removal of malicious software.

Summary

The 'src_module_index_ts' npm package, starting from version 8.2.0, has been identified as malicious due to its communication with a domain associated with malicious activity. According to the source details, any system with this package installed or running should be considered fully compromised. The package may grant an external entity full control over the affected computer, leading to potential exposure of all secrets and keys stored on it. Removal of the package is recommended; however, due to the extent of compromise, removal alone may not eliminate all malicious software introduced by the package.

References

github.com/advisories/GHSA-hppp-4j73-v9q3 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 23:22 UTC

Technical details

References

Community reviews