Supply chain · npm · High

Critical npm Package 'shopping-shared-atom-mobile-cart-counter' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-08-24

A malicious npm package, 'shopping-shared-atom-mobile-cart-counter', has been identified as malware. Installation of this package leads to full system compromise, necessitating immediate secret rotation and thorough remediation efforts.

  • Package: npm / shopping-shared-atom-mobile-cart-counter
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~25/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'shopping-shared-atom-mobile-cart-counter' has been flagged as malicious software. Any system that has installed or run this package should be considered fully compromised.

How the attack works

This attack involves the distribution of a malicious software package through a public registry. When integrated into a project and executed, the package grants an external entity full control over the compromised computer, enabling potential credential or secret theft.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines configured to pull the latest versions of dependencies
  • Organizations with internal mirrors that have synced this package

Conditions that increase exposure

  • Projects with unpinned dependencies that could inadvertently pull the malicious package
  • Lack of lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Automated build processes that install new or updated dependencies without strict vetting

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration or further lateral movement.
  • All secrets and keys stored on the compromised computer are exposed and can be stolen.
  • The integrity of development environments or production servers is severely compromised, requiring extensive recovery.

What to do (defensive)

Detect

  • Review project dependency lists (package.json) for 'shopping-shared-atom-mobile-cart-counter'.
  • Scan build artifacts and deployed environments for the presence of the package.
  • Monitor network traffic for unusual outbound connections from systems that may have installed the package.

Contain

  • Immediately isolate any system identified as having installed or run 'shopping-shared-atom-mobile-cart-counter'.
  • Block network access for compromised systems to prevent further communication with external adversaries.
  • Suspend any CI/CD pipelines or automated processes that could reintroduce the package.

Remediate

  • Consider any compromised computer as fully compromised; re-image or rebuild from a trusted source.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised computer, using a different, trusted system.
  • Remove the malicious package from all dependency lists and ensure it cannot be re-introduced into projects.

Frontier verdict — High

Prioritize immediate isolation and comprehensive secret rotation for any system exposed to this critical npm malware.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.