Threats Tagged 'mal-2026-5438'

The npm package [email protected] is a malicious package designed to perform dependency confusion by referencing a tarball hosted outside the npm registry. Installing this package causes npm to fetch and execute code from an attacker-controlled Google Cloud Storage URL, potentially compromising the host system. The package itself is a near-empty shim that exists solely to load this external malicious payload. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately. Removal of the package does not guarantee full remediation due to the potential for persistent malicious code.