Threats Tagged 'mal-2026-6185'

The conversa-sdk npm package contains malicious code in its postinstall script that reads the installer's ~/.npmrc file, which typically holds npm authentication tokens, along with system information, and sends this data to an attacker-controlled server. This behavior contradicts the package's README claims of no network calls during installation. The stolen tokens can allow attackers to publish malicious updates to other npm packages maintained by the victim, enabling supply-chain attacks. Systems with this package installed should be considered fully compromised, and all secrets and keys must be rotated immediately. Removal of the package alone does not guarantee full remediation due to potential further compromise.