Supply chain · npm · High

Critical npm package '@node-cloud/create' identified as malware

Threat Engine Auto-Feed · data current as of 2026-07-05

The npm package '@node-cloud/create' has been identified as malware, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately from a separate, secure machine due to the high risk of credential theft.

  • Package: npm / @node-cloud/create
  • Affected versions: >= 0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package '@node-cloud/create' contains malicious code that, upon installation, fully compromises the host system. This compromise grants an external entity control over the affected computer.

How the attack works

This is a malicious package attack where an attacker publishes a seemingly legitimate software component containing harmful code. When developers integrate this package into their projects, the malicious code executes during installation or runtime, enabling unauthorized access or data exfiltration.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed '@node-cloud/create'

Conditions that increase exposure

  • Unpinned dependencies allowing automatic updates to malicious versions
  • Lack of package lockfiles (e.g., package-lock.json) in projects
  • Use of internal package mirrors that do not vet upstream changes
  • Direct or transitive dependency on '@node-cloud/create'

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to further network penetration.
  • All secrets, API keys, and credentials stored on the compromised machine are exposed and likely exfiltrated.
  • The compromised system could be used as a pivot point for lateral movement within an organization's network.

What to do (defensive)

Detect

  • Scan project dependency trees for '@node-cloud/create' using package managers or security tools.
  • Monitor network traffic for unusual outbound connections from systems that installed npm packages.
  • Review system logs for suspicious process execution or file modifications post-package installation.

Contain

  • Immediately isolate any system identified with '@node-cloud/create' installed from the network.
  • Block all network traffic to and from identified compromised systems.
  • Suspend or revoke credentials associated with any user or service account that interacted with the compromised system.

Remediate

  • Consider any system that installed '@node-cloud/create' as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, API keys, and credentials that were present on or accessible from the compromised system, performing this action from a separate, secure machine.
  • Implement strict dependency pinning and review processes for all third-party packages.

Frontier verdict — High

Prioritize immediate identification, isolation, and credential rotation for any system that installed '@node-cloud/create' due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.