Supply chain · npm · High

Critical Malware in npm Package @liuliang5520500/sinataoke_cn_test

Threat Engine Auto-Feed · data current as of 2026-09-06

A critical malware package, @liuliang520500/sinataoke_cn_test, has been identified in the npm ecosystem. Installation of this package leads to full system compromise, necessitating immediate secret rotation and thorough remediation efforts.

  • Package: npm / @liuliang520500/sinataoke_cn_test
  • Affected versions: >= 0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package @liuliang520500/sinataoke_cn_test contains malware. Any system that has installed or run this package is considered fully compromised, with potential for an outside entity to gain full control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component, when integrated into a project, executes harmful code. Such attacks typically aim to establish persistence, exfiltrate sensitive data, or enable further malicious activities on the compromised system.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has directly or indirectly installed this specific package

Conditions that increase exposure

  • Unpinned dependencies that allow pulling the latest (malicious) version
  • Lack of package lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Use of internal package mirrors that may not filter malicious packages

Blast-radius scenarios

  • An attacker gains full control over the compromised computer.
  • All secrets and keys stored on the compromised computer are exposed and potentially stolen.
  • The compromised system could be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan project dependencies for the presence of @liuliang520500/sinataoke_cn_test.
  • Monitor network traffic for unusual outbound connections from systems that might have installed this package.
  • Review system logs for suspicious process execution or file modifications.

Contain

  • Immediately isolate any system identified with the @liuliang520500/sinataoke_cn_test package.
  • Block network access for compromised systems to prevent further exfiltration or command-and-control communication.
  • Suspend any CI/CD pipelines that may be pulling this package.

Remediate

  • Consider any system that installed this package as fully compromised and re-image if possible.
  • Rotate all secrets and keys (e.g., API keys, credentials, SSH keys) from a different, uncompromised computer.
  • Remove the malicious package, though this does not guarantee full removal of all malicious software due to potential full system compromise.

Frontier verdict — High

Prioritize immediate investigation and remediation for any system that installed @liuliang520500/sinataoke_cn_test due to critical system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.