Supply chain · npm · High

CRITICAL: Malicious 'html_vue' npm package compromises host systems

Threat Engine Auto-Feed · data current as of 2026-09-03

A critical vulnerability has been identified in the 'html_vue' npm package, which, if installed, fully compromises the host system. This allows for potential credential and secret theft, necessitating immediate rotation of all secrets and keys.

  • Package: npm / html_vue
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~2/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The 'html_vue' npm package contains malware that, upon installation, leads to a full compromise of the computer. This compromise may grant an outside entity complete control over the affected system.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a development or production environment. Once integrated, the malicious code executes, establishing unauthorized access and control over the host system, typically to exfiltrate sensitive data or maintain persistence.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed 'html_vue'

Conditions that increase exposure

  • Unpinned dependencies that allow automatic updates to malicious versions
  • Lack of package lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Internal package mirrors that do not vet upstream packages for malicious content
  • Automated build processes that install new or updated npm packages without security scanning

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to further network intrusion.
  • All secrets and keys stored on the compromised computer are exposed and can be stolen.
  • The compromised system could be used as a pivot point for lateral movement within an organization's network.
  • Sensitive intellectual property or customer data could be exfiltrated.

What to do (defensive)

Detect

  • Identify all systems where 'html_vue' is installed by reviewing dependency trees and package manifests.
  • Scan systems for indicators of compromise (IOCs) associated with full system compromise, such as unusual network activity or unauthorized process execution.
  • Review build logs and dependency installation records for the presence of 'html_vue'.

Contain

  • Immediately isolate any system identified with 'html_vue' installed from the network.
  • Suspend any automated builds or deployments that might pull or install 'html_vue'.
  • Block 'html_vue' at the network perimeter and within internal package registries to prevent further installation.

Remediate

  • Consider any computer with 'html_vue' installed as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on or accessible from the compromised computer, performing this action from a different, trusted system.
  • Remove the 'html_vue' package, but acknowledge that this may not fully remove all malicious software due to the nature of a full system compromise.
  • Implement stricter dependency management policies, including pinning versions and using lockfiles, and integrate supply chain security scanning into CI/CD pipelines.

Frontier verdict — High

Prioritize immediate isolation and credential rotation for any system that installed the 'html_vue' npm package due to critical system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.