Supply chain · npm · High

Critical Malicious 'onceaction' npm Package Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-09-02

A critical malicious package, 'onceaction', has been identified in the npm ecosystem. Installation of this package leads to full system compromise, necessitating immediate secret rotation and thorough remediation efforts.

  • Package: npm / onceaction
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~110/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'onceaction' has been identified as malware. Any system where this package has been installed or executed should be considered fully compromised, with potential for an outside entity to gain complete control.

How the attack works

This is a malicious package attack where a seemingly benign software component, when integrated into a project, executes harmful code. The specific mechanism involves the package gaining unauthorized access and control over the host system upon installation or execution.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Organizations with internal mirrors that have synced 'onceaction'

Conditions that increase exposure

  • Projects with unpinned dependencies that could inadvertently pull 'onceaction'
  • Lack of `package-lock.json` or `yarn.lock` to ensure deterministic dependency resolution
  • Automated build systems that do not vet third-party package integrity

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further lateral movement, or deployment of additional malware.
  • All secrets and keys stored on the compromised computer are exposed and can be stolen or misused by the attacker.
  • The integrity of development environments and build artifacts is compromised, potentially leading to supply chain poisoning of downstream projects.

What to do (defensive)

Detect

  • Scan project dependencies for 'onceaction' using package managers or security tools.
  • Review build logs and dependency trees for any indication of 'onceaction' being pulled or installed.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.

Contain

  • Immediately isolate any system identified as having installed 'onceaction' from the network.
  • Block 'onceaction' from being downloaded or installed in your environment via package registries or firewalls.
  • Suspend any automated builds or deployments that might be exposed to this package.

Remediate

  • Consider all secrets and keys on compromised systems to be stolen and rotate them immediately from a different, trusted computer.
  • Remove the 'onceaction' package from all affected systems, though this alone may not remove all malicious software.
  • Rebuild compromised systems from trusted images and implement robust security hygiene, including dependency pinning and integrity checks.

Frontier verdict — High

Prioritize immediate investigation and remediation for any systems that have installed 'onceaction' due to critical system compromise and credential theft risks.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.