MalwarePublished 29 Jun 2026

@sumoinc/trashpanda (npm) · Malicious Code

Affects @sumoinc/trashpandaSource GCVE Database

Malicious package : remove @sumoinc/trashpanda and rotate any secrets on hosts that installed it.

Data as of 29 Jun 2026, 22:26 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6650

What to do

Remove @sumoinc/trashpanda from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@sumoinc/trashpanda	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @sumoinc/trashpanda contains malicious code that fully compromises any computer where it is installed or running. The presence of this package implies that all secrets and keys stored on the affected system should be considered compromised and rotated immediately from a different, secure machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have established persistent control over the system.

Impact

Full system compromise on any computer with the package installed or running. All secrets and keys on the system are considered exposed and must be rotated. The attacker may maintain persistent access even after package removal, posing ongoing risk.

Defensive guidance

Immediately remove the @sumoinc/trashpanda package from affected systems. Rotate all secrets and keys stored on the compromised computer from a separate, secure device. Conduct a thorough investigation and remediation of the affected system, as removing the package alone may not eliminate all malicious software or attacker access.

Summary

The @sumoinc/trashpanda npm package is identified as malicious software that, when installed or executed, results in full compromise of the host computer. This compromise includes potential unauthorized access and control by an external entity. Due to the severity of the compromise, all sensitive credentials on the system must be rotated from a secure environment. The package removal does not assure complete remediation because the attacker may have deployed additional malicious components beyond the package itself.

References

github.com/advisories/GHSA-278w-vxfg-j6q2 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Jun 2026, 22:26 UTC

Technical details

References

Community reviews