Supply chain · npm · High

Critical Supply Chain Alert: Malicious 'tilaver-mfa' npm Package Discovered

Threat Engine Auto-Feed · data current as of 2026-08-11

A critical malicious package, 'tilaver-mfa', has been identified in the npm ecosystem. Installation of this package leads to full system compromise, necessitating immediate action to rotate credentials and isolate affected systems. Its presence indicates a severe security breach.

  • Package: npm / tilaver-mfa
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~40/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'tilaver-mfa' contains malware. Any system where this package has been installed or executed should be considered fully compromised. The advisory explicitly states that all secrets and keys on such a system must be rotated.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a development or production environment. Upon installation, the malware gains unauthorized access and control over the host system, typically exfiltrating sensitive data or establishing persistence.

Who's exposed

Profiles most at risk

  • Development teams using npm for package management
  • Organizations with CI/CD pipelines that pull npm dependencies
  • Any system administrator or developer who has directly installed 'tilaver-mfa'

Conditions that increase exposure

  • Unpinned dependencies allowing automatic updates to malicious versions
  • Lack of package lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Internal package mirrors that have not been scanned for malicious content
  • Automated build processes that do not vet new or updated dependencies

Blast-radius scenarios

  • An attacker gains full control over the compromised computer.
  • All secrets and keys stored on the affected system are exposed and potentially exfiltrated.
  • The compromised system could be used as a pivot point for further attacks within the network.
  • Persistence mechanisms may be established, making simple package removal insufficient for remediation.

What to do (defensive)

Detect

  • Scan dependency trees for 'tilaver-mfa' across all projects and environments.
  • Review package installation logs for any instances of 'tilaver-mfa' being pulled.
  • Monitor network traffic from systems for unusual outbound connections or data exfiltration attempts.

Contain

  • Immediately isolate any system found to have 'tilaver-mfa' installed from the network.
  • Suspend any CI/CD pipelines or automated processes that might install new dependencies until a review is complete.
  • Block 'tilaver-mfa' from being downloaded from package registries or internal mirrors.

Remediate

  • Consider any system with 'tilaver-mfa' installed as fully compromised and rebuild from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised system, doing so from a different, trusted computer.
  • Thoroughly audit all user accounts and permissions on affected systems for unauthorized changes.

Frontier verdict — High

This critical npm package compromise requires immediate isolation, credential rotation, and system rebuilds to mitigate full system control by an attacker.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.