ts-ankle (npm) · Malicious Code
Affects ts-ankleSource GCVE Database
Malicious package : remove ts-ankle and rotate any secrets on hosts that installed it.
Data as of 29 Jun 2026, 22:42 UTC
Malicious package
Published to npm · OSV MAL-2026-6548
What to do
Remove ts-ankle from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmts-ankle | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package ts-ankle version 1.1.0 contains malicious code that executes automatically upon installation. It performs two hostile actions: harvesting credential files from the user's system and exfiltrating them to a remote server, and installing an SSH backdoor by injecting a public key into authorized_keys and enabling inbound SSH access. This results in full compromise of the affected system.