Supply chain · npm · High

Critical Malware Alert: npm package 'pp-react-ui5' leads to full system compromise

Threat Engine Auto-Feed · data current as of 2026-07-27

The npm package 'pp-react-ui5' has been identified as malicious, leading to full system compromise upon installation. This poses a critical supply-chain risk, requiring immediate action to identify and remediate affected systems and rotate credentials.

  • Package: npm / pp-react-ui5
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~112/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'pp-react-ui5' contains malware. Installation or execution of this package results in a complete compromise of the host system, granting an external entity full control.

How the attack works

This is a malicious package attack, where a seemingly legitimate software component is weaponized. Upon installation, the embedded malware executes, establishing unauthorized access and control over the compromised system, typically exfiltrating sensitive data or installing further malicious software.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull npm packages, especially 'pp-react-ui5'
  • Any system where 'pp-react-ui5' has been installed or run

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the malicious version of 'pp-react-ui5'
  • Lack of package lockfiles (e.g., package-lock.json) that fix dependency versions
  • Use of internal package mirrors that may not have flagged or removed the malicious package
  • Automated build processes that install new or updated dependencies without thorough vetting

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to further network penetration.
  • All secrets and keys stored on the compromised computer are exposed and can be exfiltrated.
  • The compromised system could be used as a pivot point for lateral movement within the organization's network.
  • Sensitive intellectual property or customer data residing on the system could be stolen.

What to do (defensive)

Detect

  • Scan dependency trees for 'pp-react-ui5' in all projects using the npm ecosystem.
  • Review build logs and package installation histories for any instances of 'pp-react-ui5' being pulled.
  • Monitor network traffic from development and build systems for unusual outbound connections.

Contain

  • Immediately isolate any system identified as having installed or run 'pp-react-ui5' from the network.
  • Suspend all CI/CD pipelines and development activities that could potentially pull this package.
  • Block 'pp-react-ui5' at your package registry or proxy to prevent further accidental installations.

Remediate

  • Consider any system that installed 'pp-react-ui5' as fully compromised and re-image it from a trusted source.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised system, performing this action from a different, trusted computer.
  • Thoroughly audit all systems and networks for signs of further compromise or persistence, as removing the package itself may not remove all malicious software.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, credential rotation, and system re-imaging due to full system takeover.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.