Threats Tagged 'mal-2026-5446'

The npm package [email protected] is a hollow package that acts as a dependency confusion lure. It contains no functionality itself but declares a runtime dependency on a tarball hosted on a third-party Google Cloud Storage bucket controlled by an attacker. Installing this package causes npm to fetch and execute untrusted code from mutable infrastructure outside the npm registry, leading to full system compromise. The package name mimics a legitimate internal package to increase the chance of accidental installation. Any system with this package installed should be considered fully compromised, and all secrets on it must be rotated immediately.