Supply chain · npm · High

CRITICAL: Malicious npm package @coopeuch/config compromises host systems

Threat Engine Auto-Feed · data current as of 2026-10-12

The npm package "@coopeuch/config" has been identified as malicious. Installation of this package leads to full system compromise, necessitating immediate secret rotation and thorough remediation efforts for affected systems.

  • Package: npm / @coopeuch/config
  • Affected versions: >= 0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package "@coopeuch/config" contains malware. Any system where this package has been installed or executed should be considered fully compromised.

How the attack works

This is a malicious package attack where the act of installing or running the package introduces harmful software to the host system, granting an external entity full control over the compromised computer.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that install npm packages
  • Any user or system that has installed "@coopeuch/config"

Conditions that increase exposure

  • Projects with unpinned dependencies that might pull the malicious package
  • Environments without strict package integrity checks or lockfiles
  • Internal package mirrors that have synchronized the malicious package

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets and keys stored on the compromised computer are exposed.
  • The attacker may install additional malicious software, making simple package removal insufficient for remediation.

What to do (defensive)

Detect

  • Identify all systems where "@coopeuch/config" has been installed or run.
  • Review package lockfiles and dependency trees for the presence of "@coopeuch/config".

Contain

  • Immediately isolate any identified compromised systems from the network.
  • Prevent further installations of "@coopeuch/config" by blocking it at package registries or firewalls.

Remediate

  • Consider all secrets and keys on compromised systems to be compromised and rotate them immediately from a different, trusted computer.
  • Remove the "@coopeuch/config" package, but be aware that this may not remove all malicious software.
  • Perform a full forensic analysis and re-imaging of compromised systems, as full control may have been ceded to an attacker.

Frontier verdict — High

This is a critical severity incident requiring immediate isolation, secret rotation, and comprehensive system remediation due to full host compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.