Supply chain · npm · High

Critical npm Package 'ddok-modal' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-09-30

The npm package 'ddok-modal' version 1.0.0 contains malware that leads to full system compromise upon installation. All secrets and keys on affected systems should be considered compromised and rotated immediately, as the package grants an attacker full control.

  • Package: npm / ddok-modal
  • Affected versions: = 1.0.0
  • Severity: critical
  • Reach: ~10/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'ddok-modal' version 1.0.0 has been identified as malicious. Installation of this package results in a complete compromise of the host system, allowing an external entity full control.

How the attack works

This is a supply-chain attack where a malicious package is introduced into a software ecosystem. When a developer or automated system installs the compromised package, it executes unauthorized code, granting an attacker persistent access and control over the host system, typically for credential or secret theft.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed 'ddok-modal' version 1.0.0

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest malicious version
  • Lack of lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Use of internal mirrors that may cache and serve compromised packages
  • Automated build systems that install dependencies without prior vetting

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets, keys, and sensitive data stored on the system are exfiltrated.
  • The compromised system can be used as a pivot point for further attacks within the network.
  • Malicious software may persist on the system even after the package is removed.

What to do (defensive)

Detect

  • Scan dependency trees for 'ddok-modal' version 1.0.0.
  • Review package-lock.json or yarn.lock files for the presence of the malicious package.
  • Monitor network traffic for unusual outbound connections from systems that installed npm packages around the publication date (2026-09-30).

Contain

  • Immediately isolate any system identified with 'ddok-modal' version 1.0.0 installed.
  • Block network access for compromised systems to prevent further exfiltration or lateral movement.
  • Suspend any CI/CD pipelines or automated processes that may have installed the package.

Remediate

  • Consider any system that installed 'ddok-modal' version 1.0.0 as fully compromised and rebuild from a trusted image.
  • Rotate all secrets, API keys, and credentials that were accessible from the compromised system, performing this action from a separate, trusted machine.
  • Remove the 'ddok-modal' package, but acknowledge that full remediation may require a complete system wipe and rebuild due to potential persistent malware.

Frontier verdict — High

Prioritize immediate system isolation and credential rotation for any environment that installed 'ddok-modal' due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.