Supply chain · npm · High

Critical Malware Alert: npm package 'rebrandly-domains-search-client' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-07-01

The npm package 'rebrandly-domains-search-client' contains malware that fully compromises any system it is installed on. Due to the critical nature of this compromise, all secrets and keys on affected systems must be rotated immediately from a separate, secure machine.

  • Package: npm / rebrandly-domains-search-client
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~168/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'rebrandly-domains-search-client' has been identified as malicious. Installation of this package leads to a full compromise of the host system, granting an external entity complete control.

How the attack works

This is a malicious package attack where a seemingly legitimate software component introduces harmful code into a development or production environment. Upon installation, the embedded malware executes, establishing persistent access or exfiltrating sensitive data, leading to a complete system compromise.

Who's exposed

Profiles most at risk

  • Development teams using npm for package management
  • Organizations with CI/CD pipelines that automatically pull new package versions
  • Any user or system that has installed 'rebrandly-domains-search-client'

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing for automatic updates to malicious versions
  • Lack of package-lock.json or yarn.lock to ensure consistent dependency resolution
  • Internal package mirrors that have synchronized the malicious version
  • Automated build processes that install dependencies without manual review

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to further network penetration.
  • All secrets, keys, and sensitive data stored on the compromised machine are exposed and can be exfiltrated.
  • The compromised system could be used as a pivot point for lateral movement within an organization's network.

What to do (defensive)

Detect

  • Scan dependency trees for 'rebrandly-domains-search-client' in all projects.
  • Review package installation logs for evidence of 'rebrandly-domains-search-client' being pulled.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.

Contain

  • Immediately isolate any system found to have 'rebrandly-domains-search-client' installed from the network.
  • Block 'rebrandly-domains-search-client' from being downloaded or installed via package managers or internal registries.
  • Quarantine affected development environments and build servers.

Remediate

  • Consider any system that installed 'rebrandly-domains-search-client' as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, API keys, and credentials that were present on or accessible from compromised systems, performing rotations from a different, secure machine.
  • Remove 'rebrandly-domains-search-client' from all package.json files and ensure lock files are updated to prevent re-introduction.
  • Implement strict dependency pinning and review processes for all third-party packages.

Frontier verdict — High

This is a critical supply-chain compromise requiring immediate isolation, credential rotation, and system rebuilds due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.