Supply chain · npm · High

Critical Malware Alert: @testrelic/appium-analytics (npm) Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-08-31

A malicious version of the npm package `@testrelic/appium-analytics` (1.1.1-next.88) has been identified as malware. Installation of this package leads to full system compromise, necessitating immediate secret rotation and thorough remediation to mitigate potential credential theft and unauthorized access.

  • Package: npm / @testrelic/appium-analytics
  • Affected versions: = 1.1.1-next.88
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package `@testrelic/appium-analytics` version 1.1.1-next.88 contains malware. Any system that installed or ran this specific version should be considered fully compromised, indicating an attacker gained complete control.

How the attack works

This is a supply-chain attack where a legitimate-looking software package is injected with malicious code. When the compromised package is installed or executed, it can grant an attacker unauthorized access and control over the affected system, potentially leading to credential or secret theft.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that pull dependencies without strict version pinning
  • Organizations with internal package mirrors that may have cached the malicious version

Conditions that increase exposure

  • Unpinned dependencies allowing automatic updates to vulnerable versions
  • Lack of lockfiles (e.g., package-lock.json) to ensure consistent dependency resolution
  • Automated build systems that install dependencies from public registries without prior vetting

Blast-radius scenarios

  • An attacker gains full control over the compromised system, enabling arbitrary code execution.
  • All secrets, keys, and sensitive data stored on the affected computer are exposed and potentially exfiltrated.
  • The compromised system could be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan dependency trees for `@testrelic/appium-analytics` version 1.1.1-next.88.
  • Review build logs and package installation histories for evidence of the malicious version being pulled.
  • Monitor network traffic for unusual outbound connections from systems that installed the package.

Contain

  • Immediately isolate any system identified as having installed `@testrelic/appium-analytics@1.1.1-next.88`.
  • Block the malicious package version from being downloaded or installed in your environment.
  • Suspend any CI/CD pipelines that may have pulled the compromised package.

Remediate

  • Consider any compromised system as fully compromised; rebuild from a trusted image if possible.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised system, using a different, trusted computer.
  • Remove the malicious package from all affected systems, understanding that this may not fully remove all malicious components if full control was established.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, secret rotation, and thorough system remediation due to full system takeover.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.