Supply chain · npm · High

Critical Malicious npm Package 'procwire' Poses Full System Compromise Risk

Threat Engine Auto-Feed · data current as of 2026-06-30

The npm package 'procwire' has been identified as malicious, leading to full system compromise upon installation. This critical threat necessitates immediate action, including secret rotation and system re-imaging, due to potential persistent unauthorized access.

  • Package: npm / procwire
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~255/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'procwire' contains malware. Installation or execution of this package results in a complete compromise of the affected computer, granting an outside entity full control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a system. Upon installation, the malicious code executes, establishing unauthorized access and control over the host environment, typically exfiltrating sensitive data or installing further malware.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • CI/CD pipelines that pull npm dependencies
  • Organizations with applications dependent on 'procwire'
  • Any user or system that has installed or run 'procwire'

Conditions that increase exposure

  • Unpinned dependencies allowing automatic updates to malicious versions
  • Lack of package lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Internal package mirrors that have synchronized the malicious 'procwire' package
  • Automated build processes that do not vet new or updated dependencies

Blast-radius scenarios

  • An attacker gains full control over the compromised computer.
  • All secrets and keys stored on the compromised computer are exposed and potentially exfiltrated.
  • The compromised system may host additional malicious software, leading to persistent unauthorized access.
  • Lateral movement within the network if the compromised system has elevated privileges or access to other resources.

What to do (defensive)

Detect

  • Scan dependency trees for 'procwire' in all projects and environments.
  • Review package installation logs for 'procwire' deployments.
  • Monitor network traffic for unusual outbound connections from systems that might have installed 'procwire'.

Contain

  • Immediately isolate any systems identified with 'procwire' installed or running.
  • Block 'procwire' from being downloaded or installed from all package registries and mirrors.
  • Suspend all CI/CD pipelines that could potentially pull 'procwire' until verified clean.

Remediate

  • Consider any computer with 'procwire' installed as fully compromised and re-image it from a trusted source.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on the compromised computer, doing so from a different, uncompromised system.
  • Thoroughly audit all systems for signs of persistent compromise, even after package removal, as full control may have been established.

Frontier verdict — High

Prioritize immediate detection, isolation, and remediation for 'procwire' due to critical severity and full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.