Supply chain · npm · High

Malicious npm Package: @pwaplatform/module-sso-integration v99.0.0 Identified

Threat Engine Auto-Feed · data current as of 2026-09-20

A critical severity malicious package, `@pwaplatform/module-sso-integration` version 99.0.0, has been identified in the npm ecosystem. This package communicates with malicious domains and executes commands associated with malicious behavior, posing a significant supply-chain risk to any environment where it is installed.

  • Package: npm / @pwaplatform/module-sso-integration
  • Affected versions: = 99.0.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Malicious package

The OpenSSF Package Analysis project identified version 99.0.0 of the npm package `@pwaplatform/module-sso-integration` as malicious. Analysis revealed that this specific version engages in communication with domains linked to malicious activity and executes commands characteristic of malicious behavior.

How the attack works

This is a malicious package attack, where an attacker publishes a seemingly legitimate software component containing hidden malicious code. When developers or automated systems integrate this package into their projects, the malicious code is introduced into their build or runtime environment. The package's execution allows it to perform unauthorized actions, such as network communication to attacker-controlled infrastructure or arbitrary command execution on the host system.

Who's exposed

Profiles most at risk

  • Development teams using npm for package management
  • Organizations with CI/CD pipelines that pull npm packages
  • Any system or application that directly or indirectly depends on and installs `@pwaplatform/module-sso-integration` version 99.0.0

Conditions that increase exposure

  • Unpinned dependency versions that allow automatic updates to malicious versions
  • Lack of package lockfiles (e.g., `package-lock.json`) or not committing them to version control
  • Use of internal package mirrors that do not vet upstream packages for known malicious content
  • Automated build processes that install dependencies without prior security scanning

Blast-radius scenarios

  • An attacker could establish command and control (C2) communication from compromised build environments or deployed applications.
  • An attacker could execute arbitrary commands on systems where the package is installed, potentially leading to data exfiltration, further system compromise, or resource abuse.
  • The blast radius includes any development, testing, staging, or production environment where this specific malicious version of the package is introduced and executed.

What to do (defensive)

Detect

  • Scan `package-lock.json` or `yarn.lock` files for `@pwaplatform/module-sso-integration` version 99.0.0.
  • Review CI/CD logs for installations of the affected package version.
  • Utilize software composition analysis (SCA) tools to identify known malicious packages in your dependency tree.
  • Monitor network traffic from build systems and applications for suspicious outbound connections to unknown or flagged domains.

Contain

  • Immediately block `@pwaplatform/module-sso-integration` version 99.0.0 from being downloaded or installed via your package manager or proxy.
  • Isolate any systems or environments identified as having installed the malicious package.
  • Revoke credentials that may have been exposed on compromised systems.

Remediate

  • Remove `@pwaplatform/module-sso-integration` version 99.0.0 from all projects and environments.
  • Update `package.json` to explicitly pin safe versions of all dependencies, and commit `package-lock.json` or `yarn.lock`.
  • Rebuild and redeploy affected applications from a clean state with verified dependencies.
  • Conduct a thorough forensic analysis on any systems where the malicious package was executed to identify the extent of compromise.

Frontier verdict — High

Prioritize immediate detection and removal of `@pwaplatform/module-sso-integration` v99.0.0 due to its critical severity and confirmed malicious behavior.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.