npm Malicious npm release
Critical
Example incident
- Status
- Needs action
- Affected
- example-package 2.4.1
- Fixed in
- 2.4.2
Summary
A compromised package release may expose environment variables during installation.
Updates
-
12m ago
Fixed version published
-
46m ago
Incident confirmed
Incident brief
Malicious npm release
Critical · Needs action
Affected: example-package 2.4.1
Fixed in: 2.4.2
A compromised package release may expose environment variables during installation.
What to do:
- Check installed versions.
- Upgrade to 2.4.2.
- Rotate exposed credentials.
Sources:
- Maintainer advisory https://example.com/npm-advisory
- Release notes https://example.com/npm-release