Supply chain · npm · High

Critical Malicious Package 'far-gray-pike' Identified in npm Ecosystem

Threat Engine Auto-Feed · data current as of 2026-09-10

A critical malicious package, 'far-gray-pike' version 6.9.9, has been identified in the npm ecosystem. This poses a supply-chain risk to any projects that have integrated this specific version, potentially leading to unauthorized code execution within development or production environments. Immediate action is advised to identify and remove the affected dependency.

  • Package: npm / far-gray-pike
  • Affected versions: = 6.9.9
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Malicious package

The npm package 'far-gray-pike' version 6.9.9 contains malicious code. This indicates a supply-chain attack where a seemingly legitimate software component was compromised to deliver harmful functionality.

How the attack works

This attack involves an adversary publishing a malicious version of a package to a public registry. When developers or automated systems integrate this package into their projects, the malicious code is introduced into their build or runtime environment. The specific payload or method of compromise is not detailed, but such attacks typically aim for data exfiltration, remote code execution, or system disruption.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm dependencies
  • Security teams responsible for software supply chain integrity

Conditions that increase exposure

  • Projects directly or transitively depending on 'far-gray-pike' version 6.9.9
  • Build systems that do not pin dependency versions, allowing updates to malicious versions
  • Environments lacking robust dependency scanning or runtime monitoring
  • Internal package mirrors that have synchronized the malicious version

Blast-radius scenarios

  • An attacker could execute arbitrary code within the compromised build environment or application runtime.
  • Sensitive data (e.g., API keys, credentials, source code) could be exfiltrated from development machines or production servers.
  • The integrity of deployed applications could be compromised, leading to service disruption or further lateral movement within an organization's infrastructure.

What to do (defensive)

Detect

  • Scan `package-lock.json` or `yarn.lock` files for direct or transitive dependencies on 'far-gray-pike@6.9.9'.
  • Utilize software composition analysis (SCA) tools to identify the presence of this specific malicious package.
  • Review build logs and network traffic for unusual activity originating from projects using this dependency.

Contain

  • Immediately quarantine any build environments or systems found to have installed 'far-gray-pike@6.9.9'.
  • Block 'far-gray-pike' version 6.9.9 from being pulled from npm registries or internal mirrors.
  • Isolate affected applications or services from critical infrastructure.

Remediate

  • Remove 'far-gray-pike@6.9.9' from all project dependencies.
  • Update `package.json` to explicitly use a known safe version of 'far-gray-pike' or remove the dependency if it's not essential.
  • Clear npm caches (`npm cache clean --force`) and reinstall dependencies to ensure the malicious version is purged.
  • Rotate any credentials or API keys that may have been exposed on compromised systems.
  • Conduct a thorough forensic analysis of any systems where the malicious package was installed or executed.

Frontier verdict — High

Prioritize immediate detection and removal of 'far-gray-pike@6.9.9' due to its critical severity and supply-chain risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.