Supply chain · npm · High

Critical Malware Detected in npm Package @opap/player-kyc-widget

Threat Engine Auto-Feed · data current as of 2026-09-07

The npm package `@opap/player-kyc-widget` has been identified as malicious, leading to full system compromise upon installation. This poses a critical supply-chain risk, requiring immediate action to prevent credential theft and maintain system integrity.

  • Package: npm / @opap/player-kyc-widget
  • Affected versions: >= 0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package `@opap/player-kyc-widget` contains malware. Installation of this package results in the complete compromise of the host system, potentially allowing an attacker full control.

How the attack works

This attack involves a malicious software package being introduced into a public repository. When developers or automated systems install this package, the embedded malware executes, compromising the underlying system. This type of compromise often targets sensitive data, such as credentials and secrets.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed `@opap/player-kyc-widget`

Conditions that increase exposure

  • Unpinned dependencies that allow automatic updates to malicious versions
  • Lack of lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Use of internal mirrors that do not vet upstream package integrity
  • Automated builds that install packages without security scanning

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets and keys stored on the compromised computer are exposed and can be exfiltrated.
  • The compromised system can be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan dependency trees for `@opap/player-kyc-widget` in any version.
  • Review package-lock.json or yarn.lock files for the presence of the package.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.

Contain

  • Immediately isolate any system found to have installed `@opap/player-kyc-widget`.
  • Block network access for compromised systems to prevent further exfiltration or lateral movement.
  • Stop all builds and deployments that might pull this package.

Remediate

  • Consider any system that installed `@opap/player-kyc-widget` to be fully compromised and rebuild it from a trusted image.
  • Rotate all secrets and keys that were stored on the compromised computer, using a different, uncompromised system.
  • Remove the package from all environments, but acknowledge that removal alone may not fully eliminate the threat due to potential persistence mechanisms.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, secret rotation, and system rebuilds for any affected hosts.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.